Threats affecting pkg:composer/symfony/routing

CVE-2026-118516 is a vulnerability in the Symfony Routing component where the CompiledUrlMatcher and UrlMatcher interpret host and path information differently. This discrepancy allows path-based authorization rules to be bypassed in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. The issue arises when routes define a host with placeholders that can consume parts of the path, causing unauthorized requests to reach protected controllers.