diff --git a/composer.lock b/composer.lock
index 2fc700f7b7f57956cbdf9136aef43a1de4db36cb..f19ae91d0f43ccceb0a71debf7215a6b0d18bee1 100644
--- a/composer.lock
+++ b/composer.lock
@@ -441,7 +441,7 @@
             "dist": {
                 "type": "path",
                 "url": "core",
-                "reference": "24e68923f64073d860bf08e6c0e412614ed40703"
+                "reference": "c3581356272302fa1757a8881289fd8e05c8ca07"
             },
             "require": {
                 "asm89/stack-cors": "^2.0.2",
@@ -470,7 +470,7 @@
                 "symfony/console": "^6.1",
                 "symfony/dependency-injection": "^6.1",
                 "symfony/event-dispatcher": "^6.1",
-                "symfony/http-foundation": "^6.1.1",
+                "symfony/http-foundation": "^6.1.3",
                 "symfony/http-kernel": "^6.1",
                 "symfony/mime": "^6.1",
                 "symfony/polyfill-iconv": "^1.25",
@@ -2216,16 +2216,16 @@
         },
         {
             "name": "symfony/http-foundation",
-            "version": "v6.1.2",
+            "version": "v6.1.3",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/http-foundation.git",
-                "reference": "86119d294e51afe4d8e07da96b63332bd1f3f52c"
+                "reference": "b03712c93759a81fc243ecc18ec4637958afebdb"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/http-foundation/zipball/86119d294e51afe4d8e07da96b63332bd1f3f52c",
-                "reference": "86119d294e51afe4d8e07da96b63332bd1f3f52c",
+                "url": "https://api.github.com/repos/symfony/http-foundation/zipball/b03712c93759a81fc243ecc18ec4637958afebdb",
+                "reference": "b03712c93759a81fc243ecc18ec4637958afebdb",
                 "shasum": ""
             },
             "require": {
@@ -2268,7 +2268,7 @@
             "description": "Defines an object-oriented layer for the HTTP specification",
             "homepage": "https://symfony.com",
             "support": {
-                "source": "https://github.com/symfony/http-foundation/tree/v6.1.2"
+                "source": "https://github.com/symfony/http-foundation/tree/v6.1.3"
             },
             "funding": [
                 {
@@ -2284,7 +2284,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2022-06-19T13:21:48+00:00"
+            "time": "2022-07-27T15:50:51+00:00"
         },
         {
             "name": "symfony/http-kernel",
diff --git a/composer/Metapackage/CoreRecommended/composer.json b/composer/Metapackage/CoreRecommended/composer.json
index 6496c519006e3fc3cc50ff1d3b119e93bfc2c42d..db36a54462ac17fe7938fc125ee6babd958597c2 100644
--- a/composer/Metapackage/CoreRecommended/composer.json
+++ b/composer/Metapackage/CoreRecommended/composer.json
@@ -35,7 +35,7 @@
         "symfony/error-handler": "~v6.1.0",
         "symfony/event-dispatcher": "~v6.1.0",
         "symfony/event-dispatcher-contracts": "~v3.1.0",
-        "symfony/http-foundation": "~v6.1.2",
+        "symfony/http-foundation": "~v6.1.3",
         "symfony/http-kernel": "~v6.1.2",
         "symfony/mime": "~v6.1.1",
         "symfony/polyfill-ctype": "~v1.26.0",
diff --git a/core/composer.json b/core/composer.json
index c908860853b69fe925666eeabd97c0c911350498..0ca7697c5dca31b1b10be4a2c30a14ec42aa0f71 100644
--- a/core/composer.json
+++ b/core/composer.json
@@ -21,7 +21,7 @@
         "symfony/console": "^6.1",
         "symfony/dependency-injection": "^6.1",
         "symfony/event-dispatcher": "^6.1",
-        "symfony/http-foundation": "^6.1.1",
+        "symfony/http-foundation": "^6.1.3",
         "symfony/http-kernel": "^6.1",
         "symfony/mime": "^6.1",
         "symfony/routing": "^6.1",
diff --git a/core/modules/system/tests/modules/router_test_directory/src/TestControllers.php b/core/modules/system/tests/modules/router_test_directory/src/TestControllers.php
index ff36b8aa593bcac9d16cfd0fb717d16fbfab007d..252ac6a176ecdaaecfde618becfde0291199b18c 100644
--- a/core/modules/system/tests/modules/router_test_directory/src/TestControllers.php
+++ b/core/modules/system/tests/modules/router_test_directory/src/TestControllers.php
@@ -15,12 +15,14 @@
  */
 class TestControllers {
 
+  const LONG_TEXT = 'This is text long enough to trigger Apache mod_deflate to add a `vary: accept-encoding` header to the response.';
+
   public function test() {
     return new Response('test');
   }
 
   public function test1() {
-    return new Response('test1');
+    return new Response(self::LONG_TEXT);
   }
 
   public function test2() {
diff --git a/core/modules/system/tests/src/Functional/Routing/RouterTest.php b/core/modules/system/tests/src/Functional/Routing/RouterTest.php
index 8a032049a5648c05b0d58e6d8cf8166bd96e35d0..66bcc5f70cd683563690ab4e711ef467b73ab2e6 100644
--- a/core/modules/system/tests/src/Functional/Routing/RouterTest.php
+++ b/core/modules/system/tests/src/Functional/Routing/RouterTest.php
@@ -5,6 +5,7 @@
 use Drupal\Core\Cache\Cache;
 use Drupal\Core\EventSubscriber\MainContentViewSubscriber;
 use Drupal\Core\Language\LanguageInterface;
+use Drupal\router_test\TestControllers;
 use Drupal\Tests\BrowserTestBase;
 use Symfony\Component\Routing\Exception\RouteNotFoundException;
 use Drupal\Core\Url;
@@ -38,14 +39,16 @@ public function testFinishResponseSubscriber() {
 
     // Confirm that the router can get to a controller.
     $this->drupalGet('router_test/test1');
-    $this->assertSession()->pageTextContains('test1');
+    $this->assertSession()->pageTextContains(TestControllers::LONG_TEXT);
     $session = $this->getSession();
 
     // Check expected headers from FinishResponseSubscriber.
     $this->assertSession()->responseHeaderEquals('Content-language', 'en');
     $this->assertSession()->responseHeaderEquals('X-Content-Type-Options', 'nosniff');
     $this->assertSession()->responseHeaderEquals('X-Frame-Options', 'SAMEORIGIN');
-    $this->assertSession()->responseHeaderDoesNotExist('Vary');
+    if (strcasecmp($session->getResponseHeader('vary'), 'accept-encoding') !== 0) {
+      $this->assertSession()->responseHeaderDoesNotExist('Vary');
+    }
 
     $this->drupalGet('router_test/test2');
     $this->assertSession()->pageTextContains('test2');