The vulnerability originates from Symfony's RequestMatcher, which compares the HTTP method of a request with a list of allowed methods verbatim. Because the HTTP router treats a HEAD request as a GET request, a HEAD request can be routed to the same controller that is protected by security rules or firewalls that are configured to apply only to GET requests. This allows an attacker to trigger the controller’s logic, including any side effects, and to read response headers, thereby bypassing access‑control restrictions that were intended to be limited to GET methods.

Affected products include Symfony's http‑foundation component, with vulnerable releases up to and including 5.4.55, 6.4.49, 7.4.22, and 8.1.10. Custom firewall configurations that rely on the RequestMatcher or custom request_matcher implementations are also exposed. All versions of Symfony prior to 5.4.56, 6.4.50, 7.4.23, and 8.1.11 contain this flaw.

The CVSS score of 6.3 indicates moderate risk, and the EPSS score is not currently available. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw over any network path that can send HTTP HEAD requests to the application, such as publicly exposed web services. Once exploited, the attacker can read response headers and cause the execution of protected controller code. No publicly documented exploits are known yet, but the absence of a KEV listing does not rule out the presence of undisclosed attacks.