Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2020-5255: Symfony Website Can Return Wrong Content Type

CVE-2020-5255 · published 6 years ago

Summary

Certain versions of Symfony may return incorrect content type in responses without a Content-Type header, potentially breaking the website for other users. This issue affects versions of Symfony prior to 4.4.7 and 5.0.7. Update to a patched version to prevent this issue.

What to do

Update symfony http-foundation to version 4.4.7.
Update symfony http-foundation to version 5.0.7.
Update symfony symfony to version 4.4.7.
Update symfony symfony to version 5.0.7.

Affected software

Ecosystem	Vendor	Product	Affected versions
composer	symfony	http-foundation	>= 4.4.0, < 4.4.7 >= 5.0.0, < 5.0.7 Fix: upgrade to 4.4.7
composer	symfony	symfony	>= 4.4.0, < 4.4.7 >= 5.0.0, < 5.0.7 Fix: upgrade to 4.4.7
–	sensiolabs	symfony	>= 4.4.0, < 4.4.7 >= 5.0.0, < 5.0.7 `cpe:2.3:a:sensiolabs:symfony::::::::`

Original advisory text

In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fallback to the format defined in the `Accept` header of the request, leading to a possible mismatch between the response's content and `Content-Type` header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

4.3 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-435Improper Interaction Between Multiple Correctly-Behaving Entities

CWE-20Improper Input Validation

Timeline

Published30 Mar 2020

Updated4 Nov 2026

First seen6 Mar 2026

Sources

GHSA-mcx4-f5f5-4859 · GHSA

CVE-2020-5255 · NVD

Track software like this

Free during beta