{"id":"CVE-2018-14774","aliases":["GHSA-66p6-7p29-55p9"],"url":"https://o3.security/vulnerability/CVE-2018-14774","summary":"Symfony Host Header Injection","details":"An issue was discovered in HttpKernel in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. When using HttpCache, the values of the X-Forwarded-Host headers are implicitly set as trusted while this should be forbidden, leading to potential host header injection.","published":"2018-08-03T17:29:00.347Z","modified":"2026-10-24T10:50:31.699604514Z","cvss":{"score":7.2,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"2.7.49"},{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"2.8.44"},{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"3.3.18"},{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"3.4.14"},{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"4.0.14"},{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"4.1.3"}],"fix":{"url":"https://github.com/symfony/symfony/commit/725dee4cd8b4ccd52e335ae4b4522242cea9bd4a","label":"symfony/symfony@725dee4"},"references":[{"type":"FIX","url":"https://github.com/symfony/symfony/commit/725dee4cd8b4ccd52e335ae4b4522242cea9bd4a"},{"type":"FIX","url":"https://symfony.com/blog/cve-2018-14774-possible-host-header-injection-when-using-httpcache"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14774"},{"type":"WEB","url":"https://github.com/symfony/symfony/commit/7f912bbb78377c2ea331b3da28363435fbd91337"},{"type":"WEB","url":"https://github.com/symfony/symfony/commit/96504fb8c9f91204727d2930eb837473ce154956"},{"type":"WEB","url":"https://github.com/symfony/symfony/commit/974240e178bb01d734bf1df1ad5c3beba6a2f982"},{"type":"WEB","url":"https://github.com/symfony/symfony/commit/9cfcaba0bf71f87683510b5f47ebaac5f5d6a5ba"},{"type":"WEB","url":"https://github.com/symfony/symfony/commit/bcf5897bb1a99d4acae8bf7b73e81bfdeaac0922"},{"type":"PACKAGE","url":"https://github.com/symfony/symfony"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T10:50:31.699604514Z"}}