Medium
Security advisory
In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fallback to the format defined in the `Accept` header of the request, leading to a possible mismatch between the response's content and `Content-Type` header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-5255
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 08:54 UTC · Revision 1
Source evidence
In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fallback to the format defined in the `Accept` header of the request, leading to a possible mismatch between the response's content and `Content-Type` header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7.
osv:CVE-2020-5255
Complete source record
{
"id": "97e2eb2eaed7f462df0187af0b9e4b2af4b98e08c1d29c55560e35a4b0beedef",
"url": "https://osv.dev/vulnerability/CVE-2020-5255",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-5255",
"summary": "In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fallback to the format defined in the `Accept` header of the request, leading to a possible mismatch between the response's content and `Content-Type` header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7.",
"evidence": "osv:CVE-2020-5255",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2020-5255",
"aliases": [
"BIT-symfony-2020-5255",
"CVE-2020-5255",
"GHSA-mcx4-f5f5-4859"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/symfony/security-http",
"type": "GIT",
"events": [
{
"introduced": "e49361b75e9acbc029b35ae4ba957e712137286b"
},
{
"fixed": "b413064160255c31077bb082d25b7bd89275971b"
},
{
"introduced": "18f96c1f4aff294d6872908741731ff0993dbd6f"
},
{
"fixed": "af7315dafa9e402969f1cc433a8f719a4b9bcd98"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.4.0"
},
{
"fixed": "4.4.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.0.7"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v5.0.6",
"v4.4.6",
"v5.0.5",
"v4.4.5",
"v5.0.4",
"v4.4.4",
"v5.0.3",
"v4.4.3",
"v5.0.2",
"v4.4.2",
"v5.0.1",
"v4.4.1",
"v4.4.0",
"v5.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-5255.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/symfony/symfony",
"type": "GIT",
"events": [
{
"introduced": "625a4dbfdafcb8cea8ff90a62b9c24b28694938d"
},
{
"fixed": "0889df1e88559968eb291c938d25b96e252f7bed"
},
{
"introduced": "ea815ba986fe3be54acb5a47b0dc8760cf54e31d"
},
{
"fixed": "93313a03cfdb3b9c994ae8e414267efcc010262d"
},
{
"fixed": "dca343442e6a954f96a2609e7b4e9c21ed6d74e6"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.4.0"
},
{
"fixed": "4.4.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.0.7"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "dca343442e6a954f96a2609e7b4e9c21ed6d74e6"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v5.0.6",
"v4.4.6",
"v5.0.5",
"v4.4.5",
"v5.0.4",
"v4.4.4",
"v5.0.3",
"v4.4.3",
"v4.4.2",
"v5.0.2",
"v5.0.1",
"v4.4.1",
"v5.0.0",
"v4.4.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-5255.json"
}
}
],
"modified": "2026-10-24T10:50:39.317914392Z",
"provider": "osv",
"references": [
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C36JLPHUPKDFAX6D5WYFC4ALO2K7RDUQ/",
"https://github.com/symfony/symfony/security/advisories/GHSA-mcx4-f5f5-4859",
"https://symfony.com/blog/cve-2020-5255-prevent-cache-poisoning-via-a-response-content-type-header",
"https://github.com/symfony/symfony/commit/dca343442e6a954f96a2609e7b4e9c21ed6d74e6"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2020-5255",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 442412,
"published_at": "2020-03-30T20:15:19.57+00:00"
}