"Symfony\Component\HttpFoundation\RequestMatcher", and "RequestMatcher\MethodRequestMatcher" which replaces it from 6.2 on, match a request against a list of HTTP methods. They compared the request method to the list verbatim, while the router serves a "HEAD" request with the "GET" handler, as HTTP semantics require. Anything restricted to "GET" through such a matcher therefore did not apply to the same URL requested with "HEAD". The reachable consequence is "security.access_control", whose rules SecurityBundle compiles into these matchers, and firewalls, whose "methods" option is compiled the same way: The response carries no body, but its headers leak, and the controller executes with any side effect it has. A firewall restricted with "methods: [GET]" has the same gap: a "HEAD" request falls through to the next firewall matching the path, or to none. An application that builds a request matcher itself, for a custom firewall "request_matcher" or for any other method-restricted decision, is affected the same way. The fix for CVE-2026-45075 addressed the same gap in the "#[IsGranted]", "#[IsSignatureValid]" and "#[IsCsrfTokenValid]" attributes only.