CWE-436

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "rack",
          "vendor": "rack",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.2.25"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0, \u003c 3.1.23"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.2, \u003c 3.2.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser.parse_boundary can skip a leading empty or quoted boundary parameter in a multipart Content-Type header and accept a later parameter. Rack can therefore parse a request body with a boundary that a conforming intermediary would not derive, allowing form fields or file uploads to reach an application without the intended proxy or web application firewall inspection. This issue is fixed in versions 2.2.25, 3.1.23, and 3.2.8."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436: Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T21:55:20.600Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rack/rack/security/advisories/GHSA-p8x9-v4hv-2w4g",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rack/rack/security/advisories/GHSA-p8x9-v4hv-2w4g"
        },
        {
          "name": "https://github.com/rack/rack/commit/19a1a19cb4da97d61c8d5effeb2e927c44370ae9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rack/rack/commit/19a1a19cb4da97d61c8d5effeb2e927c44370ae9"
        },
        {
          "name": "https://github.com/rack/rack/commit/a29512324265790a5536b830490075d0d79323be",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rack/rack/commit/a29512324265790a5536b830490075d0d79323be"
        },
        {
          "name": "https://github.com/rack/rack/commit/d5e928b803da30b8e40171dbd4be39bed7daa6fa",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rack/rack/commit/d5e928b803da30b8e40171dbd4be39bed7daa6fa"
        },
        {
          "name": "https://github.com/rack/rack/releases/tag/v2.2.25",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rack/rack/releases/tag/v2.2.25"
        },
        {
          "name": "https://github.com/rack/rack/releases/tag/v3.1.23",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rack/rack/releases/tag/v3.1.23"
        },
        {
          "name": "https://github.com/rack/rack/releases/tag/v3.2.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rack/rack/releases/tag/v3.2.8"
        }
      ],
      "source": {
        "advisory": "GHSA-p8x9-v4hv-2w4g",
        "discovery": "UNKNOWN"
      },
      "title": "Rack: Multipart boundary ambiguity guard in Rack::Multipart::Parser can be bypassed with a quoted boundary value, allowing WAF bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-125108",
    "datePublished": "2026-11-09T21:55:20.600Z",
    "dateReserved": "2026-11-09T17:45:35.935Z",
    "dateUpdated": "2026-11-09T21:55:20.600Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-122310",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T16:12:00.687669Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T16:54:07.737Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/kyverno/kyverno",
          "product": "kyverno",
          "vendor": "kyverno",
          "versions": [
            {
              "lessThan": "1.19.2",
              "status": "affected",
              "version": "1.19.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.19.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.19.2",
                  "versionStartIncluding": "1.19.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "cherez0ff"
        }
      ],
      "datePublic": "2026-10-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Kyverno from 1.19.1 before 1.19.2 validates a Policy\u0027s context.apiCall urlPath after cleaning it but executes the raw path, whose fragment or query the Kubernetes client discards. A namespace-scoped user who can create a Policy can hide ../ segments behind # or ? to reach cluster-scoped endpoints with Kyverno\u0027s ServiceAccount, gaining cluster admin."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T02:25:12.955Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-3xfv-vq8x-qhg4)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-3xfv-vq8x-qhg4"
        },
        {
          "name": "VulnCheck Advisory: Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPath",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/kyverno-1.19.1-before-1.19.2-privilege-escalation-via-policy-apicall-urlpath"
        }
      ],
      "title": "Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPath",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-122310",
    "datePublished": "2026-11-05T02:25:12.955Z",
    "dateReserved": "2026-11-04T23:23:51.290Z",
    "dateUpdated": "2026-11-09T16:54:07.737Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-120635",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T19:07:24.249552Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T19:08:06.676Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "CGI"
          ],
          "packageName": "CGI",
          "packageURL": "pkg:cpan/CGI",
          "programFiles": [
            "lib/CGI.pm"
          ],
          "programRoutines": [
            {
              "name": "CGI::read_multipart"
            },
            {
              "name": "CGI::_mp_value_parse"
            },
            {
              "name": "CGI::MultipartBuffer::new"
            },
            {
              "name": "CGI::MultipartBuffer::read"
            }
          ],
          "repo": "https://github.com/leejo/CGI.pm",
          "versions": [
            {
              "lessThan": "5.00",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs.\n\nThe multipart/form-data parser matches the boundary anywhere rather than at the start of a line, uses the boundary without its leading -- for some client-supplied User-Agent values, finds the Content-Disposition name and filename inside the quoted values of other parameters, and corrupts parts when the boundary nears the 4096-byte read size."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436 Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:40:15.070Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://www.rfc-editor.org/rfc/rfc2046#section-5.1.1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/LEEJO/CGI-5.00/changes"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/leejo/CGI.pm/commit/f719fc08e8756708bcd4f1e357d5c0f8702f85dd.patch"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/leejo/CGI.pm/commit/cbf04979f9974458ac223793bbd9d0b6a772aa66.patch"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/leejo/CGI.pm/commit/fe9516804d59a3774e280c15dbb7072fbd0ba5f1.patch"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/leejo/CGI.pm/commit/e0ef8f4248c6ae3025749040d8595d206b6a1b49.patch"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to CGI 5.00 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-120635",
    "datePublished": "2026-11-03T23:40:15.070Z",
    "dateReserved": "2026-11-02T17:40:25.384Z",
    "dateUpdated": "2026-11-09T19:08:06.676Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-120309",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T14:21:34.272355Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T14:21:44.137Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/nuxt",
          "product": "nuxt",
          "vendor": "nuxt",
          "versions": [
            {
              "lessThan": "4.6.2",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.6.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/%40nuxt/nitro-server",
          "product": "nuxt",
          "vendor": "nuxt",
          "versions": [
            {
              "lessThan": "4.6.2",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.6.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.6.2",
                  "versionStartIncluding": "4.6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nuxt:nuxt\\/nitro-server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.6.2",
                  "versionStartIncluding": "4.6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "seslo82"
        }
      ],
      "datePublic": "2026-10-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Nuxt from 4.6.0 before 4.6.2 contains a route parameter confusion vulnerability in getRouterParam and getRouterParams that lets attackers return a parameter value different from the one h3 matched by sending paths containing an encoded question mark (%3F). Attackers can craft requests where authorization checks use the Nuxt helper value while resource selection uses event.context.params, allowing access to unauthorized resources."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T02:01:09.557Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-w7gw-66vg-99gq)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-w7gw-66vg-99gq"
        },
        {
          "name": "VulnCheck Advisory: Nuxt 4.6.0 before 4.6.2 Route Param Confusion via getRouterParam",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nuxt-4.6.0-before-4.6.2-route-param-confusion-via-getrouterparam"
        }
      ],
      "title": "Nuxt 4.6.0 before 4.6.2 Route Param Confusion via getRouterParam",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-120309",
    "datePublished": "2026-11-02T02:01:09.557Z",
    "dateReserved": "2026-11-01T12:48:05.669Z",
    "dateUpdated": "2026-11-02T14:21:44.137Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-120213",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T17:04:58.190785Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T17:05:17.281Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/@fastify/http-proxy",
          "product": "@fastify/http-proxy",
          "vendor": "@fastify/http-proxy",
          "versions": [
            {
              "lessThan": "11.6.6",
              "status": "affected",
              "version": "9.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "11.6.6",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Panelv4"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "UlisesGascon"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "mcollina"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded route parameters into rewritePrefix without re-encoding them. A parameter value that encodes a path separator together with a fragment or query delimiter therefore decodes into real separators and delimiters that inject extra upstream path segments and strip the mandatory suffix the rewritePrefix was meant to enforce, without using any dot-dot traversal. An unauthenticated remote attacker can use this to reach upstream locations outside the intended prefix, leading to path-restriction bypass and, depending on the upstream, server-side request forgery or authorization bypass in the proxied service. The issue is fixed in @fastify/http-proxy 11.6.6, and users should upgrade to 11.6.6 or later. There is no workaround other than upgrading."
            }
          ],
          "value": "@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded route parameters into rewritePrefix without re-encoding them. A parameter value that encodes a path separator together with a fragment or query delimiter therefore decodes into real separators and delimiters that inject extra upstream path segments and strip the mandatory suffix the rewritePrefix was meant to enforce, without using any dot-dot traversal. An unauthenticated remote attacker can use this to reach upstream locations outside the intended prefix, leading to path-restriction bypass and, depending on the upstream, server-side request forgery or authorization bypass in the proxied service. The issue is fixed in @fastify/http-proxy 11.6.6, and users should upgrade to 11.6.6 or later. There is no workaround other than upgrading."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436: Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T10:15:08.777Z",
        "orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "shortName": "openjs"
      },
      "references": [
        {
          "url": "https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-h3vp-4jfr-v364"
        },
        {
          "url": "https://cna.openjsf.org/security-advisories.html"
        }
      ],
      "title": "@fastify/http-proxy vulnerable to prefix escape via decoded route parameters",
      "x_generator": {
        "engine": "cve-kit 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
    "assignerShortName": "openjs",
    "cveId": "CVE-2026-120213",
    "datePublished": "2026-11-02T10:15:08.777Z",
    "dateReserved": "2026-10-31T13:33:29.612Z",
    "dateUpdated": "2026-11-02T17:05:17.281Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119200",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T01:41:18.080980Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T01:41:26.806Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nuxt",
          "vendor": "nuxt",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.6.0, \u003c 4.6.3"
            }
          ]
        },
        {
          "product": "nitro-server",
          "vendor": "@nuxt",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.6.0, \u003c 4.6.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-encoded dot segments before rendering a page while Nitro routing, server/middleware checks, and server route rules evaluate the unresolved path. A request such as /%2e/admin can therefore render app/pages/admin.vue and its server-rendered data while checks keyed to /admin, redirects, or per-route security headers do not apply. API handlers, appMiddleware, Nuxt 3, and Nuxt 4.0.0 through 4.5.x are not affected, and exploitation requires a client that sends dot segments without browser normalization. This issue is fixed in version 4.6.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-41",
              "description": "CWE-41: Improper Resolution of Path Equivalence",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436: Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T20:17:08.837Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nuxt/nuxt/security/advisories/GHSA-9v7c-q64q-vv33",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-9v7c-q64q-vv33"
        },
        {
          "name": "https://github.com/nuxt/nuxt/commit/45463f8b58487e387149ebfb704d6a0834b3a450",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuxt/nuxt/commit/45463f8b58487e387149ebfb704d6a0834b3a450"
        },
        {
          "name": "https://github.com/nuxt/nuxt/releases/tag/v4.6.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuxt/nuxt/releases/tag/v4.6.3"
        }
      ],
      "source": {
        "advisory": "GHSA-9v7c-q64q-vv33",
        "discovery": "UNKNOWN"
      },
      "title": "Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-119200",
    "datePublished": "2026-10-29T20:17:08.837Z",
    "dateReserved": "2026-10-29T16:04:48.728Z",
    "dateUpdated": "2026-11-04T01:41:26.806Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119190",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T20:24:38.825329Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T20:25:04.131Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-5x38-2vff-x55p"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "forge",
          "vendor": "digitalbazaar",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain() used the first extension with that name. Exploitation requires a CA trusted by the application to issue a certificate carrying an attacker-supplied deprecated-OID extension, commonly because the CA copies extensions from a certificate signing request. By placing a permissive deprecated extension before the genuine 2.5.29.19 basicConstraints extension, the certificate holder could have the certificate accepted as a CA and issue certificates for arbitrary names, enabling server or client impersonation. If the issuing CA adds a keyUsage extension without keyCertSign, node-forge rejects the chain. This issue is fixed in version 1.4.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436: Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T19:25:09.677Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-5x38-2vff-x55p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-5x38-2vff-x55p"
        },
        {
          "name": "https://github.com/digitalbazaar/forge/commit/58c06bc251856b409c30ecb35a93f5f6c9bbc84a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/digitalbazaar/forge/commit/58c06bc251856b409c30ecb35a93f5f6c9bbc84a"
        },
        {
          "name": "https://github.com/digitalbazaar/forge/releases/tag/v1.4.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"
        }
      ],
      "source": {
        "advisory": "GHSA-5x38-2vff-x55p",
        "discovery": "UNKNOWN"
      },
      "title": "Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-119190",
    "datePublished": "2026-10-29T19:25:09.677Z",
    "dateReserved": "2026-10-29T16:04:48.728Z",
    "dateUpdated": "2026-10-29T20:25:04.131Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-118517",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T16:49:56.410466Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T16:52:28.063Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org/packages/symfony/http-client",
          "defaultStatus": "unaffected",
          "modules": [
            "Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer"
          ],
          "packageName": "symfony/http-client",
          "product": "symfony",
          "repo": "https://github.com/symfony/http-client",
          "vendor": "sensiolabs",
          "versions": [
            {
              "lessThan": "6.4.50",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "git"
            },
            {
              "lessThan": "7.4.23",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "git"
            },
            {
              "lessThan": "8.1.11",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.50",
                  "versionStartIncluding": "6.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.4.23",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8.1.11",
                  "versionStartIncluding": "8.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nicolas Grekas"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ilia Alshanetsky"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe Symfony HtmlSanitizer component \u003ccode\u003eUrlSanitizer\u003c/code\u003e\u0026nbsp;parses URLs differently from browsers, allowing\u0026nbsp;\u003cspan\u003ethe \u003c/span\u003e\u003ccode\u003eallowLinkHosts()\u003c/code\u003e\u003cspan\u003e and \u003c/span\u003e\u003ccode\u003eallowMediaHosts()\u003c/code\u003e\u003cspan\u003e checks to be bypassed for URLs without a well-formed authority,\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003eresulting in untrusted hosts being referenced in sanitized output\u003cspan\u003e\u0026nbsp;in Symfony versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003ccode\u003eUrlSanitizer\u003c/code\u003e\u003cspan\u003e parses URLs with \u003c/span\u003e\u003ccode\u003eleague/uri\u003c/code\u003e\u003cspan\u003e, which follows RFC 3986, while browsers follow the WHATWG URL standard.\u0026nbsp;\u003c/span\u003eFor URLs without a well-formed authority, such as \u003ccode\u003ehttp:evil.example\u003c/code\u003e, \u003ccode\u003e///evil.example\u003c/code\u003e, or \u003ccode\u003ehttps://://evil.example/\u0026nbsp;\u003c/code\u003et\u003cspan\u003ehe sanitizer finds no host, whereas browsers resolve them to \u003c/span\u003e\u003ccode\u003eevil.example\u003c/code\u003e\u003cspan\u003e. The guard added for CVE-2026-45066 missed the zero-slash form, and the host \u003c/span\u003e\u003ccode\u003e0\u003c/code\u003e\u003cspan\u003e was also skipped because PHP treats it as falsy.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003eThis is exploitable when a host allow-list is combined with \u003c/span\u003e\u003ccode\u003eallowRelativeLinks(true)\u003c/code\u003e\u003cspan\u003e or \u003c/span\u003e\u003ccode\u003eallowRelativeMedias(true)\u003c/code\u003e\u003cspan\u003e. The default configuration is not affected.\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "The Symfony HtmlSanitizer component UrlSanitizer\u00a0parses URLs differently from browsers, allowing\u00a0the allowLinkHosts() and allowMediaHosts() checks to be bypassed for URLs without a well-formed authority,\u00a0resulting in untrusted hosts being referenced in sanitized output\u00a0in Symfony versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\n\n\n\nUrlSanitizer parses URLs with league/uri, which follows RFC 3986, while browsers follow the WHATWG URL standard.\u00a0For URLs without a well-formed authority, such as http:evil.example, ///evil.example, or https://://evil.example/\u00a0the sanitizer finds no host, whereas browsers resolve them to evil.example. The guard added for CVE-2026-45066 missed the zero-slash form, and the host 0 was also skipped because PHP treats it as falsy.\n\n\n\nThis is exploitable when a host allow-list is combined with allowRelativeLinks(true) or allowRelativeMedias(true). The default configuration is not affected."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-184",
              "description": "CWE-184 Incomplete List of Disallowed Inputs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436 Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T16:26:52.166Z",
        "orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
        "shortName": "Checkmarx"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/symfony/symfony/security/advisories/GHSA-c76g-9c4c-gxrw"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/symfony/symfony/commit/f2f47d2eef6c2552c6c5c24953caa94f7901cb43"
        }
      ],
      "source": {
        "advisory": "GHSA-c76g-9c4c-gxrw",
        "discovery": "UNKNOWN"
      },
      "title": "Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority (Incomplete Fix for CVE-2026-45066)",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
    "assignerShortName": "Checkmarx",
    "cveId": "CVE-2026-118517",
    "datePublished": "2026-11-05T16:26:52.166Z",
    "dateReserved": "2026-10-28T14:33:36.992Z",
    "dateUpdated": "2026-11-05T16:52:28.063Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118516",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T21:12:52.419903Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T21:13:06.710Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org/packages/symfony/routing",
          "defaultStatus": "unaffected",
          "modules": [
            "Symfony\\Component\\Routing\\Matcher\\CompiledUrlMatcher"
          ],
          "packageName": "symfony/routing",
          "product": "symfony",
          "repo": "https://github.com/symfony/routing",
          "vendor": "sensiolabs",
          "versions": [
            {
              "lessThan": "5.4.56",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            },
            {
              "lessThan": "6.4.50",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "git"
            },
            {
              "lessThan": "7.4.23",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "git"
            },
            {
              "lessThan": "8.1.11",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.56",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.50",
                  "versionStartIncluding": "6.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.4.23",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8.1.11",
                  "versionStartIncluding": "8.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Vincent Cassiau (CyberVanguard)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nicolas Grekas"
        }
      ],
      "datePublic": "2026-11-04T12:32:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eThe Symfony Routing components\u0026nbsp;\u003ccode\u003eCompiledUrlMatcher\u003c/code\u003e and \u003ccode\u003eUrlMatcher\u0026nbsp;\u003c/code\u003e\u003cspan\u003einterpret the host and path information differently, allowing\u0026nbsp;\u003c/span\u003epath-based authorization rules to be bypassed in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eFor routes that define a host,\u0026nbsp;\u003ccode\u003eCompiledUrlMatcher\u003c/code\u003e\u0026nbsp;matches the string\u0026nbsp;\u003ccode\u003e$host.\u0027.\u0027.$pathinfo\u0026nbsp;\u003c/code\u003eagainst the host regular expression followed by the path regular expression, while\u0026nbsp;\u003ccode\u003eUrlMatcher\u003c/code\u003e\u0026nbsp;matches the host and the path separately. A\u003cspan\u003e\u0026nbsp;host placeholder can therefore\u0026nbsp; match\u0026nbsp;\u003c/span\u003e\u003ccode\u003e/\u003c/code\u003e\u003cspan\u003e,\u0026nbsp;\u003c/span\u003eand consume the beginning of the path\u003cspan\u003e, so the request is routed to a controller, while\u0026nbsp;\u003c/span\u003e\u003ccode\u003eUrlMatcher\u003c/code\u003e\u003cspan\u003e\u0026nbsp; would find no route.\u0026nbsp;\u003c/span\u003e\u003cspan\u003eRules that look at the path, such as\u0026nbsp;\u003c/span\u003e\u003ccode\u003eaccess_control\u003c/code\u003e\u003cspan\u003e\u0026nbsp;entries and firewall patterns,\u0026nbsp;\u003c/span\u003eare evaluated against the actual request path\u003cspan\u003e, so they do not apply while the controller of the route runs,\u0026nbsp;\u003c/span\u003epotentially allowing an unauthenticated request to reach a protected controller. For example, w\u003cspan\u003eith the route\u0026nbsp;\u003c/span\u003e\u003ccode\u003e/admin/report/{id}\u003c/code\u003e\u003cspan\u003e, the host\u0026nbsp;\u003c/span\u003e\u003ccode\u003eapp.{domain}\u003c/code\u003e\u003cspan\u003e\u0026nbsp;and the rule\u0026nbsp;\u003c/span\u003e\u003ccode\u003eaccess_control:\u0026nbsp;[{ path: ^/admin, roles: ROLE_ADMIN }]\u003c/code\u003e\u003cspan\u003e, an anonymous request for\u0026nbsp;\u003c/span\u003e\u003ccode\u003e/admin/report/1\u003c/code\u003e\u003cspan\u003e\u0026nbsp;is sent to the login page. A request with the Host header\u0026nbsp;\u003c/span\u003e\u003ccode\u003eapp\u003c/code\u003e\u003cspan\u003e\u0026nbsp;and path\u0026nbsp;\u003c/span\u003e\u003ccode\u003e/x./admin/report/1\u003c/code\u003e\u003cspan\u003e\u0026nbsp;instead reaches the controller, with\u0026nbsp;\u003c/span\u003e\u003ccode\u003edomain=\"/x\"\u003c/code\u003e\u003cspan\u003e. With the required\u0026nbsp;\u003c/span\u003e\u003ccode\u003edomain: .+\u003c/code\u003e\u003cspan\u003e, the real hostname works:\u0026nbsp;\u003c/span\u003e\u003ccode\u003eapp.example.com\u003c/code\u003e\u003cspan\u003e\u0026nbsp;and\u0026nbsp;\u003c/span\u003e\u003ccode\u003e/x./admin/report/1\u0026nbsp;\u003c/code\u003e\u003cspan\u003ematch with\u0026nbsp;\u003c/span\u003e\u003ccode\u003edomain=\"example.com./x\"\u003c/code\u003e\u003cspan\u003e.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003eApplications are affected if they have routes with host placeholders protected by path-based rules. With the default requirement, the Host header must be the host of the route without its last labels, such as\u0026nbsp;\u003c/span\u003e\u003ccode\u003eapp: framework.trusted_hosts\u003c/code\u003e\u003cspan\u003e\u0026nbsp;blocks that, while a web server that only serves known names may not, for instance, Nginx passing the raw Host header to FastCGI for a request line that carries an absolute URI. If the requirement accepts /, such as .+, a real hostname works, and\u0026nbsp;\u003c/span\u003e\u003ccode\u003etrusted_hosts\u003c/code\u003e\u003cspan\u003e\u0026nbsp;does not help.\u003c/span\u003e\u003c/div\u003e"
            }
          ],
          "value": "The Symfony Routing components\u00a0CompiledUrlMatcher and UrlMatcher\u00a0interpret the host and path information differently, allowing\u00a0path-based authorization rules to be bypassed in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\n\n\n\n\nFor routes that define a host,\u00a0CompiledUrlMatcher\u00a0matches the string\u00a0$host.\u0027.\u0027.$pathinfo\u00a0against the host regular expression followed by the path regular expression, while\u00a0UrlMatcher\u00a0matches the host and the path separately. A\u00a0host placeholder can therefore\u00a0 match\u00a0/,\u00a0and consume the beginning of the path, so the request is routed to a controller, while\u00a0UrlMatcher\u00a0 would find no route.\u00a0Rules that look at the path, such as\u00a0access_control\u00a0entries and firewall patterns,\u00a0are evaluated against the actual request path, so they do not apply while the controller of the route runs,\u00a0potentially allowing an unauthenticated request to reach a protected controller. For example, with the route\u00a0/admin/report/{id}, the host\u00a0app.{domain}\u00a0and the rule\u00a0access_control:\u00a0[{ path: ^/admin, roles: ROLE_ADMIN }], an anonymous request for\u00a0/admin/report/1\u00a0is sent to the login page. A request with the Host header\u00a0app\u00a0and path\u00a0/x./admin/report/1\u00a0instead reaches the controller, with\u00a0domain=\"/x\". With the required\u00a0domain: .+, the real hostname works:\u00a0app.example.com\u00a0and\u00a0/x./admin/report/1\u00a0match with\u00a0domain=\"example.com./x\".\n\n\n\n\nApplications are affected if they have routes with host placeholders protected by path-based rules. With the default requirement, the Host header must be the host of the route without its last labels, such as\u00a0app: framework.trusted_hosts\u00a0blocks that, while a web server that only serves known names may not, for instance, Nginx passing the raw Host header to FastCGI for a request line that carries an absolute URI. If the requirement accepts /, such as .+, a real hostname works, and\u00a0trusted_hosts\u00a0does not help."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436 Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T18:10:27.489Z",
        "orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
        "shortName": "Checkmarx"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/symfony/symfony/security/advisories/GHSA-xqw3-x93m-887x"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/symfony/symfony/commit/067cde51e29f6d605de4de53322a02c6e23b5416"
        }
      ],
      "source": {
        "advisory": "GHSA-xqw3-x93m-887x",
        "discovery": "UNKNOWN"
      },
      "title": "Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
    "assignerShortName": "Checkmarx",
    "cveId": "CVE-2026-118516",
    "datePublished": "2026-11-04T12:33:08.482Z",
    "dateReserved": "2026-10-28T14:33:36.992Z",
    "dateUpdated": "2026-11-09T21:13:06.710Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116695",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T12:10:05.530836Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T12:13:04.293Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "crass",
          "vendor": "rgrove",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules inside a bad URL token even though a browser treats them as live CSS. A sanitizer that parses untrusted CSS with Crass and reserializes it without rejecting the bad URL can allow CSS used for UI redress, external resource loading, or CSS-based data exfiltration, but this issue does not enable script execution in modern browsers. This issue is fixed in version 1.0.8."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436: Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T20:10:34.010Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rgrove/crass/security/advisories/GHSA-pq4g-8rxf-4g29",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rgrove/crass/security/advisories/GHSA-pq4g-8rxf-4g29"
        },
        {
          "name": "https://github.com/rgrove/crass/commit/689fc45c632fdf3803b2f4e844ffc9cca3b08f34",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rgrove/crass/commit/689fc45c632fdf3803b2f4e844ffc9cca3b08f34"
        },
        {
          "name": "https://github.com/rgrove/crass/releases/tag/v1.0.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rgrove/crass/releases/tag/v1.0.8"
        }
      ],
      "source": {
        "advisory": "GHSA-pq4g-8rxf-4g29",
        "discovery": "UNKNOWN"
      },
      "title": "Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-116695",
    "datePublished": "2026-10-27T20:10:34.010Z",
    "dateReserved": "2026-10-26T20:00:59.831Z",
    "dateUpdated": "2026-11-03T12:13:04.293Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}