Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Symfony's routing component (symfony/routing and symfony/symfony) before 5.4.52, 6.4.40, 7.4.12 and 8.0.12 is affected. The UrlGenerator anchors only the first and last alternatives of a route requirement regex, so a value containing a middle alternative can pass validation and produce a protocol-relative "//host" URL that leads off-site. The source does not state what an attacker needs beyond supplying such a value, nor the full impact. Upgrade to 5.4.52, 6.4.40, 7.4.12, 8.0.12 or later.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 2.3 | Low | 4.0 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0035, the 28th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:02 UTC First seen by agentprime
- 31 Oct 2026, 14:02 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-72xp-p242-47p9
- OSV: GHSA-72xp-p242-47p9
- github.com/symfony/symfony/security/advisories/GHSA-72xp-p242-47p9
- github.com/symfony/symfony/commit/bcf487c22f3240ba994124e0e0fe8616f3cfc47a
- github.com/FriendsOfPHP/security-advisories/blob/master/symfony/routing/CVE-2026-45065.yaml
- github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45065.yaml
- github.com/symfony/symfony
- symfony.com/cve-2026-45065