CVE-2014-5244: Symfony HttpFoundation Component Denial of Service Vulnerability
Summary
CVE-2014-5244: Symfony vulnerable to denial of service via a malicious HTTP Host header. Affects symfony/http-foundation across 3 version ranges.
>= 2.0.0, < 2.3.19
>= 2.4.0, < 2.4.9
>= 2.5.0, < 2.5.4
Fixed in 2.3.19, 2.4.9 or 2.5.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Symfony HttpFoundation component is a part of the Symfony framework and provides an object-oriented layer for the HTTP protocol. It handles HTTP requests and responses, including parsing and manipulating headers, cookies, and other HTTP-related tasks. This vulnerability affects versions 2.0.X to 2.5.X of the Symfony HttpFoundation component.
Vulnerability Detail
The vulnerability in the Symfony HttpFoundation component allows for a denial of service (DoS) attack through a malicious HTTP Host header. When a client sends an excessively long hostname, the parsing of this hostname in the Request::getHost() method can lead to a DoS attack. This is due to the way the hostname is validated using a regular expression. An attacker can exploit this vulnerability to cause the application to consume excessive resources, resulting in a denial of service.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.3.192.3.19composer require symfony/http-foundation:2.3.19 -
>= 2.4.0, < 2.4.92.4.9composer require symfony/http-foundation:2.4.9 -
>= 2.5.0, < 2.5.42.5.4composer require symfony/http-foundation:2.5.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The Symfony HttpFoundation component is vulnerable to a denial of service attack through a malicious HTTP Host header. To mitigate this vulnerability, it is recommended to update the Symfony framework to the fixed versions. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for symfony/http-foundation →
FAQ
Versions 2.0.X to 2.5.X of the Symfony HttpFoundation component are affected.
The vulnerability allows for a denial of service (DoS) attack, potentially causing the application to consume excessive resources and become unresponsive.
No fixes are provided for Symfony versions 2.0, 2.1, and 2.2 as they are no longer maintained. It is recommended to update to a supported version.
The patch for this vulnerability is available on GitHub at the following URL: https://github.com/symfony/symfony/pull/11828
Yes, the CVSS score for this vulnerability is 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
References
Related vulnerabilities
Recent vulnerabilities recorded for symfony/http-foundation.
