CVE-2026-45065 Overview
CVE-2026-45065 is an input validation flaw in the Symfony PHP framework's UrlGenerator component. The vulnerability affects Symfony versions prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12. The UrlGenerator builds validation patterns as ^ plus the raw requirement plus $. When developers use ungrouped alternations in route requirements, middle alternatives match as unanchored substrings. An attacker can supply a value such as //evil.com that satisfies a common locale requirement and produces a protocol-relative off-site URL. The issue is tracked as [CWE-185: Incorrect Regular Expression].
Critical Impact
Attackers can craft route parameters that generate protocol-relative URLs pointing to attacker-controlled domains, enabling open redirect and phishing scenarios in applications built on Symfony.
Affected Products
- Symfony versions prior to 5.4.52
- Symfony versions prior to 6.4.40 and 7.4.12
- Symfony versions prior to 8.0.12
Discovery Timeline
- 2026-07-14 - CVE-2026-45065 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-45065
Vulnerability Analysis
The flaw resides in how Symfony's UrlGenerator validates route parameters before substituting them into generated URLs. Symfony wraps the developer-provided requirement string with ^ and $ anchors to enforce full-string matching. This construction is unsafe when the requirement contains an ungrouped alternation such as en|fr|de.
Regular expression precedence causes the anchors to bind only to the outermost alternatives. The pattern ^en|fr|de$ matches any string beginning with en or any string ending with de, and also any string that contains fr as a substring. The middle alternatives are effectively unanchored.
An attacker submits a value like //evil.com for a _locale parameter. If the requirement contains a middle alternative that appears as a substring in the payload, validation passes. UrlGenerator then embeds the value into the output URL, producing a protocol-relative link that browsers resolve to the attacker's domain.
Root Cause
The root cause is improper anchoring of user-supplied regex fragments. Symfony concatenates anchors around raw requirement strings without wrapping them in a non-capturing group, so alternation operators bind at a wider scope than intended. This mismatch between developer expectation and regex semantics allows crafted values to bypass parameter validation.
Attack Vector
Exploitation requires an application that uses UrlGenerator with route requirements containing ungrouped alternations, and that reflects generated URLs into responses or redirects. An attacker submits a crafted parameter value through any input that reaches URL generation. The resulting protocol-relative URL supports phishing, credential theft, and abuse of trust in the host application's domain.
No code example is included because no verified proof-of-concept is available. See the GitHub Security Advisory GHSA-72xp-p242-47p9 for the vendor's technical description.
Detection Methods for CVE-2026-45065
Indicators of Compromise
- Outbound HTTP redirects or generated links containing // followed by an unexpected external hostname in application logs.
- Route parameter values in access logs that begin with // or contain URL delimiter characters where a locale or short identifier is expected.
- User reports of redirects from trusted application URLs to unrelated external sites.
Detection Strategies
- Audit Symfony route definitions for requirements entries containing ungrouped alternations such as en|fr|de instead of (?:en|fr|de).
- Inspect web server and application logs for requests to routes that generate URLs, filtering for parameter values containing /, \, :, or . characters.
- Run static analysis across the codebase to flag calls to UrlGeneratorInterface::generate() where inputs originate from untrusted request data.
Monitoring Recommendations
- Monitor for anomalous Location response headers pointing to external domains from routes that historically produced same-origin URLs.
- Alert on spikes in 302/301 responses containing protocol-relative targets.
- Track deployed Symfony versions across services and flag hosts running releases below 5.4.52, 6.4.40, 7.4.12, or 8.0.12.
How to Mitigate CVE-2026-45065
Immediate Actions Required
- Upgrade Symfony to 5.4.52, 6.4.40, 7.4.12, or 8.0.12 depending on the branch in use.
- Review all route requirements and wrap alternations in non-capturing groups, for example (?:en|fr|de).
- Validate any request data that feeds into URL generation against a strict allowlist before passing it to UrlGenerator.
Patch Information
Symfony published fixes in the following releases: Symfony v5.4.52, Symfony v6.4.40, Symfony v7.4.12, and Symfony v8.0.12. Details are documented in the GitHub Security Advisory GHSA-72xp-p242-47p9.
Workarounds
- Rewrite route requirements to group alternations explicitly, for example changing _locale: en|fr|de to _locale: (?:en|fr|de).
- Add server-side validation on generated URLs to reject values beginning with //, /\, or containing scheme separators before they are returned to clients.
- Configure web application firewall rules to block route parameter values that contain URL delimiter characters where short identifiers are expected.
# Configuration example: update Composer dependency to a patched release
composer require symfony/routing:^7.4.12
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
