CVE-2026-45065

Analyzed Analyzed - Analysis Complete

Protocol-Relative URL Generation in Symfony Framework

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, UrlGenerator validates route parameters against a pattern built as ^ plus the raw requirement plus $; with ungrouped alternations, middle alternatives match as unanchored substrings, allowing a value such as //evil.com to satisfy a common locale requirement and generate a protocol-relative off-site URL. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-45065

EUVD

EUVD-2026-44323

Affected Vendors & Products

Vendor	Product	Version / Range
sensiolabs	symfony	From 7.0.0 (inc) to 7.4.12 (exc)
sensiolabs	symfony	From 8.0.0 (inc) to 8.0.12 (exc)
sensiolabs	symfony	to 5.4.52 (exc)
sensiolabs	symfony	From 6.0.0 (inc) to 6.4.40 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
CWE-185	The product specifies a regular expression in a way that causes data to be improperly matched or compared.

Attack-Flow Graph

Executive Summary

CVE-2026-45065 is a security flaw in Symfony's UrlGenerator component where improper regex alternation anchoring allows attackers to manipulate URL generation. The issue occurs when route parameters use ungrouped alternations in regex requirements, causing middle alternatives to match as unanchored substrings. This enables inputs like //evil.com to bypass locale validation and generate off-site URLs.

Detection Guidance

To detect this vulnerability, check Symfony framework versions in use. Run commands like 'composer show symfony/symfony' or 'php -r "echo Symfony\Component\HttpKernel\Kernel::VERSION;"' to verify if installed versions are below 5.4.52, 6.4.40, 7.4.12, or 8.0.12. Inspect route configurations for regex requirements using alternations (e.g., _locale: 'ar|bg|vi|zh_CN').

Review application logs for unusual URL generation patterns or off-site redirects. Test routes with inputs like '//evil.com' to see if they bypass validation. Use static analysis tools to scan for improper regex anchoring in route definitions.

Impact Analysis

This vulnerability could allow attackers to redirect users to malicious off-site locations via protocol-relative URLs. It may also enable unauthorized access or bypass security checks if your application uses Symfony's routing with regex alternations in route parameters.

Compliance Impact

This vulnerability could lead to violations of data protection regulations like GDPR (unauthorized data access) or HIPAA (unsecured redirects exposing PHI) if exploited to redirect users to malicious sites or bypass security controls. Organizations must patch to maintain compliance.

Mitigation Strategies

Immediately update Symfony to patched versions: 5.4.52, 6.4.40, 7.4.12, or 8.0.12. If updating is not possible, review all route configurations to remove unanchored regex alternations in requirements. Replace patterns like _locale: 'ar|bg|vi' with explicit alternatives or non-alternation regex.

Apply input validation for route parameters to reject protocol-relative URLs or suspicious substrings. Monitor network traffic for unexpected off-site redirects. Consider temporary disabling affected routes until patches are applied.

Hi! I’m here to help you understand CVE-2026-45065. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70