GIVE YOUR AGENT THE EVIDENCE

Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

GIVE YOUR AGENT THE EVIDENCE

Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

cve.new
GHSA-wvjv-p5rr-mmqmhigh7.5

Symfony allows direct access of ESI URLs behind a trusted proxy

Check your stack

The advisory, in context

All 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony HttpKernel component are affected by this security issue. Your application is vulnerable only if the ESI feature is enabled and there is a proxy in front of the web application.

This issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.2 as it is not maintained anymore.

Description When you enable the ESI feature and when you are using a proxy like Varnish that you configured as a trusted proxy, the FragmentHandler considered requests to render fragments as coming from a trusted source, even if the client was requesting them directly. Symfony can not distinguish between ESI requests done on behalf of the client by Varnish and faked fragment requests coming directly from the client.

To mitigate this issue, and for not-supported Symfony versions, you can use the following workaround in your Varnish configuration (/_fragment being the URL path prefix configured under the fragment setting of the framework bundle configuration):

Copy sub vcl_recv { if (req.restarts == 0 && req.url ~ "^/_fragment") { error 400; } } Resolution We do not rely on trusted IPs anymore when validating a fragment request as all fragment URLs are now signed.

The patch for this issue is available here: https://github.com/symfony/symfony/pull/11831

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

Ecosystem versions

From 2.0.0 before 2.3.19

Fixed in 2.3.19

65 explicitly affected versions

2.0.4, 2.0.5, 2.0.6, 2.0.7, v2.0.10, v2.0.12, v2.0.13, v2.0.14, v2.0.15, v2.0.16, v2.0.17, v2.0.18, v2.0.19, v2.0.20, v2.0.21, v2.0.22, v2.0.23, v2.0.24, v2.0.25, v2.0.9, v2.1.0, v2.1.1, v2.1.10, v2.1.11, v2.1.12, v2.1.13, v2.1.2, v2.1.3, v2.1.4, v2.1.5, v2.1.6, v2.1.7, v2.1.8, v2.1.9, v2.2.0, v2.2.1, v2.2.10, v2.2.11, v2.2.2, v2.2.3, v2.2.4, v2.2.5, v2.2.6, v2.2.7, v2.2.8, v2.2.9, v2.3.0, v2.3.1, v2.3.10, v2.3.11, v2.3.12, v2.3.13, v2.3.14, v2.3.15, v2.3.16, v2.3.17, v2.3.18, v2.3.2, v2.3.3, v2.3.4, v2.3.5, v2.3.6, v2.3.7, v2.3.8, v2.3.9

View affected-version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "2.0.0"
        },
        {
          "fixed": "2.3.19"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "2.0.4",
    "2.0.5",
    "2.0.6",
    "2.0.7",
    "v2.0.10",
    "v2.0.12",
    "v2.0.13",
    "v2.0.14",
    "v2.0.15",
    "v2.0.16",
    "v2.0.17",
    "v2.0.18",
    "v2.0.19",
    "v2.0.20",
    "v2.0.21",
    "v2.0.22",
    "v2.0.23",
    "v2.0.24",
    "v2.0.25",
    "v2.0.9",
    "v2.1.0",
    "v2.1.1",
    "v2.1.10",
    "v2.1.11",
    "v2.1.12",
    "v2.1.13",
    "v2.1.2",
    "v2.1.3",
    "v2.1.4",
    "v2.1.5",
    "v2.1.6",
    "v2.1.7",
    "v2.1.8",
    "v2.1.9",
    "v2.2.0",
    "v2.2.1",
    "v2.2.10",
    "v2.2.11",
    "v2.2.2",
    "v2.2.3",
    "v2.2.4",
    "v2.2.5",
    "v2.2.6",
    "v2.2.7",
    "v2.2.8",
    "v2.2.9",
    "v2.3.0",
    "v2.3.1",
    "v2.3.10",
    "v2.3.11",
    "v2.3.12",
    "v2.3.13",
    "v2.3.14",
    "v2.3.15",
    "v2.3.16",
    "v2.3.17",
    "v2.3.18",
    "v2.3.2",
    "v2.3.3",
    "v2.3.4",
    "v2.3.5",
    "v2.3.6",
    "v2.3.7",
    "v2.3.8",
    "v2.3.9"
  ]
}
Ecosystem versions

From 2.4.0 before 2.4.9

Fixed in 2.4.9

9 explicitly affected versions

v2.4.0, v2.4.1, v2.4.2, v2.4.3, v2.4.4, v2.4.5, v2.4.6, v2.4.7, v2.4.8

View affected-version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "2.4.0"
        },
        {
          "fixed": "2.4.9"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v2.4.0",
    "v2.4.1",
    "v2.4.2",
    "v2.4.3",
    "v2.4.4",
    "v2.4.5",
    "v2.4.6",
    "v2.4.7",
    "v2.4.8"
  ]
}
Ecosystem versions

From 2.5.0 before 2.5.4

Fixed in 2.5.4

4 explicitly affected versions

v2.5.0, v2.5.1, v2.5.2, v2.5.3

View affected-version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "2.5.0"
        },
        {
          "fixed": "2.5.4"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v2.5.0",
    "v2.5.1",
    "v2.5.2",
    "v2.5.3"
  ]
}
Ecosystem versions

From 2.0.0 before 2.3.19

Fixed in 2.3.19

80 explicitly affected versions

2.0.4, 2.0.5, 2.0.6, 2.0.7, v2.0.10, v2.0.11, v2.0.12, v2.0.13, v2.0.14, v2.0.15, v2.0.16, v2.0.17, v2.0.18, v2.0.19, v2.0.20, v2.0.21, v2.0.22, v2.0.23, v2.0.24, v2.0.25, v2.0.9, v2.1.0, v2.1.0-BETA1, v2.1.0-BETA2, v2.1.0-BETA3, v2.1.0-BETA4, v2.1.0-RC1, v2.1.0-RC2, v2.1.1, v2.1.10, v2.1.11, v2.1.12, v2.1.13, v2.1.2, v2.1.3, v2.1.4, v2.1.5, v2.1.6, v2.1.7, v2.1.8, v2.1.9, v2.2.0, v2.2.0-BETA1, v2.2.0-BETA2, v2.2.0-RC1, v2.2.0-RC2, v2.2.0-RC3, v2.2.1, v2.2.10, v2.2.11, v2.2.2, v2.2.3, v2.2.4, v2.2.5, v2.2.6, v2.2.7, v2.2.8, v2.2.9, v2.3.0, v2.3.0-BETA1, v2.3.0-BETA2, v2.3.0-RC1, v2.3.1, v2.3.10, v2.3.11, v2.3.12, v2.3.13, v2.3.14, v2.3.15, v2.3.16, v2.3.17, v2.3.18, v2.3.2, v2.3.3, v2.3.4, v2.3.5, v2.3.6, v2.3.7, v2.3.8, v2.3.9

View affected-version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "2.0.0"
        },
        {
          "fixed": "2.3.19"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "2.0.4",
    "2.0.5",
    "2.0.6",
    "2.0.7",
    "v2.0.10",
    "v2.0.11",
    "v2.0.12",
    "v2.0.13",
    "v2.0.14",
    "v2.0.15",
    "v2.0.16",
    "v2.0.17",
    "v2.0.18",
    "v2.0.19",
    "v2.0.20",
    "v2.0.21",
    "v2.0.22",
    "v2.0.23",
    "v2.0.24",
    "v2.0.25",
    "v2.0.9",
    "v2.1.0",
    "v2.1.0-BETA1",
    "v2.1.0-BETA2",
    "v2.1.0-BETA3",
    "v2.1.0-BETA4",
    "v2.1.0-RC1",
    "v2.1.0-RC2",
    "v2.1.1",
    "v2.1.10",
    "v2.1.11",
    "v2.1.12",
    "v2.1.13",
    "v2.1.2",
    "v2.1.3",
    "v2.1.4",
    "v2.1.5",
    "v2.1.6",
    "v2.1.7",
    "v2.1.8",
    "v2.1.9",
    "v2.2.0",
    "v2.2.0-BETA1",
    "v2.2.0-BETA2",
    "v2.2.0-RC1",
    "v2.2.0-RC2",
    "v2.2.0-RC3",
    "v2.2.1",
    "v2.2.10",
    "v2.2.11",
    "v2.2.2",
    "v2.2.3",
    "v2.2.4",
    "v2.2.5",
    "v2.2.6",
    "v2.2.7",
    "v2.2.8",
    "v2.2.9",
    "v2.3.0",
    "v2.3.0-BETA1",
    "v2.3.0-BETA2",
    "v2.3.0-RC1",
    "v2.3.1",
    "v2.3.10",
    "v2.3.11",
    "v2.3.12",
    "v2.3.13",
    "v2.3.14",
    "v2.3.15",
    "v2.3.16",
    "v2.3.17",
    "v2.3.18",
    "v2.3.2",
    "v2.3.3",
    "v2.3.4",
    "v2.3.5",
    "v2.3.6",
    "v2.3.7",
    "v2.3.8",
    "v2.3.9"
  ]
}
Ecosystem versions

From 2.4.0 before 2.4.9

Fixed in 2.4.9

9 explicitly affected versions

v2.4.0, v2.4.1, v2.4.2, v2.4.3, v2.4.4, v2.4.5, v2.4.6, v2.4.7, v2.4.8

View affected-version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "2.4.0"
        },
        {
          "fixed": "2.4.9"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v2.4.0",
    "v2.4.1",
    "v2.4.2",
    "v2.4.3",
    "v2.4.4",
    "v2.4.5",
    "v2.4.6",
    "v2.4.7",
    "v2.4.8"
  ]
}
Ecosystem versions

From 2.5.0 before 2.5.4

Fixed in 2.5.4

4 explicitly affected versions

v2.5.0, v2.5.1, v2.5.2, v2.5.3

View affected-version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "2.5.0"
        },
        {
          "fixed": "2.5.4"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v2.5.0",
    "v2.5.1",
    "v2.5.2",
    "v2.5.3"
  ]
}

References