Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-48736

Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6, allowing attacker-supplied URLs to represent private IPv4 targets in forms that IpUtils::isPrivateIp() did not block. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

symfony symfony

  • >= 5.4.0, < 5.4.53affected
  • >= 6.0.0-BETA1, < 6.4.41affected
  • >= 7.0.0-BETA1, < 7.4.13affected
  • >= 8.0.0-BETA1, < 8.0.13affected

symfony http-client

  • >= 5.4.0, < 5.4.53affected

symfony http-foundation

  • >= 6.0.0-BETA1, < 6.4.41affected
  • >= 7.0.0-BETA1, < 7.4.13affected
  • >= 8.0.0-BETA1, < 8.0.13affected

References