CVE-2024-50345

symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `Request` class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the `Request` class to redirect users to another domain. The `Request::create` methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-601

• https://github.com/symfony/symfony/security/advisories/GHSA-mrqx-rp3w-jpjpVendor Advisory
• https://url.spec.whatwg.orgIssue Tracking
• https://lists.debian.org/debian-lts-announce/2025/05/msg00051.html

Published

Nov 6, 2024

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-5034The SULly WordPress plugin before 4.3.1 does not have CSRF c…8.8
• CVE-2024-50340symfony/runtime is a module for the Symphony PHP framework w…7.3
• CVE-2024-50341symfony/security-bundle is a module for the Symphony PHP fra…3.1
• CVE-2024-50342symfony/http-client is a module for the Symphony PHP framewo…4.3
• CVE-2024-50343symfony/validator is a module for the Symphony PHP framework…3.1
• CVE-2024-50344I, Librarian is an open-source version of a PDF managing Saa…4.6
• CVE-2024-50346WebFeed is a lightweight web feed reader extension for Firef…5.1
• CVE-2024-50347Laravel Reverb provides a real-time WebSocket communication …6.3
• CVE-2024-50348InstantCMS is a free and open source content management syst…5.4
• CVE-2024-50349Git is a fast, scalable, distributed revision control system…4.7
• CVE-2024-5035The affected device expose a network service called "rftest"…8.8
• CVE-2024-50350LibreNMS is an open-source, PHP/MySQL/SNMP-based network mon…5.4