CVE-2026-48736
CVE-2026-48736 · Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6, allowing attacker-supplied URLs to represent private IPv4 targets in forms that IpUtils::isPrivateIp() did not block. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.
CVSS 6.9 · Medium · EPSS 0.6% · Fix available
- Published
- Updated
Affected products and versions
symfony
- Versions
- >= 5.4.0, < 5.4.53: Affected
- >= 6.0.0-BETA1, < 6.4.41: Affected
- >= 7.0.0-BETA1, < 7.4.13: Affected
- >= 8.0.0-BETA1, < 8.0.13: Affected
No fix published
http-client
- Versions
- >= 5.4.0, < 5.4.53: Affected
No fix published
http-foundation
- Versions
- >= 6.0.0-BETA1, < 6.4.41: Affected
- >= 7.0.0-BETA1, < 7.4.13: Affected
- >= 8.0.0-BETA1, < 8.0.13: Affected
No fix published
symfony Debian:12
- Versions
- 5.4.23+dfsg-1
- 5.4.23+dfsg-1+deb12u1
- 5.4.23+dfsg-1+deb12u2
- 5.4.23+dfsg-1+deb12u3
- 5.4.23+dfsg-1+deb12u4
- 5.4.23+dfsg-1+deb12u5
- 5.4.24+dfsg-1
- 5.4.25+dfsg-1
- 5.4.27+dfsg-1
- 5.4.28+dfsg-1
- 5.4.29+dfsg-1
- 5.4.30+dfsg-1
- 5.4.31+dfsg-1
- 5.4.31+dfsg-2
- 5.4.32+dfsg-1
- 5.4.33+dfsg-1
- 5.4.34+dfsg-1
- 5.4.34+dfsg-2
- 5.4.35+dfsg-1
- 5.4.35+dfsg-2
- 5.4.35+dfsg-3
- 5.4.52+dfsg-0+deb12u1
- Affected ranges
- ECOSYSTEM: < 5.4.53+dfsg-0+deb12u1
Update to 5.4.53+dfsg-0+deb12u1
symfony Debian:13
- Versions
- 6.4.21+dfsg-2
- 6.4.21+dfsg-2+deb13u1
- 6.4.24+dfsg-1
- 6.4.25+dfsg-1
- 6.4.40+dfsg-0+deb13u1
- Affected ranges
- ECOSYSTEM: < 6.4.41+dfsg-0+deb13u1
Update to 6.4.41+dfsg-0+deb13u1
symfony Debian:14
- Versions
- 6.4.21+dfsg-2
- 6.4.24+dfsg-1
- 6.4.25+dfsg-1
- 7.0.4+dfsg-1
- 7.0.5+dfsg-1
- 7.0.6+dfsg-1
- 7.0.7+dfsg-1
- 7.1.0~beta1+dfsg-1
- 7.1.0~rc1+dfsg-1
- 7.1.2+dfsg-1
- 7.1.3+dfsg-1
- 7.1.4+dfsg-1
- 7.1.5+dfsg-1
- 7.2.0~beta1+dfsg-1
- 7.2.0~beta2+dfsg-1
- 7.2.0~rc1+dfsg-1
- 7.2.1+dfsg-1
- 7.2.2+dfsg-1
- 7.2.3+dfsg-1
- 7.2.4+dfsg-1
- 7.2.5+dfsg-1
- 7.2.6-1
- 7.3.0+dfsg-1
- 7.3.0~beta1+dfsg-1
- 7.3.0~beta2+dfsg-1
- 7.3.0~rc1+dfsg-1
- 7.3.1+dfsg-1
- 7.3.2+dfsg-1
- 7.3.3+dfsg-1
- 7.3.4+dfsg-1
- 7.3.5-1
- 7.4.0+dfsg-1
- 7.4.0+dfsg-2
- 7.4.0~beta1-1
- 7.4.0~beta1-2
- 7.4.0~beta2+dfsg-1
- 7.4.0~beta2+dfsg-2
- 7.4.0~beta2+dfsg-3
- 7.4.0~rc1+dfsg-1
- 7.4.0~rc2+dfsg-1
- 7.4.0~rc3+dfsg-1
- 7.4.10+dfsg-1
- 7.4.12+dfsg-1
- 7.4.2+dfsg-1
- 7.4.2+dfsg-2
- 7.4.3+dfsg-1
- 7.4.4+dfsg-1
- 7.4.5+dfsg-1
- 7.4.6+dfsg-1
- 7.4.6+dfsg-2
- 7.4.7+dfsg-1
- 7.4.8+dfsg-1
- 7.4.9+dfsg-1
- Affected ranges
- ECOSYSTEM: < 7.4.13+dfsg-1
Update to 7.4.13+dfsg-1
symfony/http-client Packagist
- Versions
- v5.4.0
- v5.4.1
- v5.4.11
- v5.4.12
- v5.4.13
- v5.4.14
- v5.4.15
- v5.4.16
- v5.4.17
- v5.4.19
- v5.4.2
- v5.4.20
- v5.4.21
- v5.4.22
- v5.4.23
- v5.4.24
- v5.4.25
- v5.4.26
- v5.4.29
- v5.4.3
- v5.4.31
- v5.4.34
- v5.4.35
- v5.4.36
- v5.4.37
- v5.4.38
- v5.4.39
- v5.4.40
- v5.4.41
- v5.4.42
- v5.4.43
- v5.4.44
- v5.4.45
- v5.4.46
- v5.4.47
- v5.4.48
- v5.4.49
- v5.4.5
- v5.4.7
- v5.4.8
- v5.4.9
- Affected ranges
- ECOSYSTEM: ≥ 5.4.0, < 5.4.53
Update to 5.4.53
symfony/http-foundation Packagist
- Versions
- v6.4.0
- v6.4.10
- v6.4.12
- v6.4.13
- v6.4.14
- v6.4.15
- v6.4.16
- v6.4.18
- v6.4.2
- v6.4.21
- v6.4.22
- v6.4.23
- v6.4.24
- v6.4.25
- v6.4.26
- v6.4.28
- v6.4.29
- v6.4.3
- v6.4.30
- v6.4.31
- v6.4.32
- v6.4.33
- v6.4.34
- v6.4.35
- v6.4.4
- v6.4.7
- v6.4.8
- Affected ranges
- ECOSYSTEM: ≥ 6.4.0, < 6.4.41
Update to 6.4.41
symfony/http-foundation Packagist
- Versions
- v7.0.0
- v7.0.10
- v7.0.3
- v7.0.4
- v7.0.6
- v7.0.7
- v7.0.8
- v7.1.0
- v7.1.0-BETA1
- v7.1.0-RC1
- v7.1.1
- v7.1.10
- v7.1.11
- v7.1.3
- v7.1.5
- v7.1.6
- v7.1.7
- v7.1.8
- v7.1.9
- v7.2.0
- v7.2.0-BETA1
- v7.2.0-BETA2
- v7.2.0-RC1
- v7.2.2
- v7.2.3
- v7.2.5
- v7.2.6
- v7.2.7
- v7.2.8
- v7.2.9
- v7.3.0
- v7.3.0-BETA1
- v7.3.0-BETA2
- v7.3.0-RC1
- v7.3.1
- v7.3.10
- v7.3.11
- v7.3.2
- v7.3.3
- v7.3.4
- v7.3.5
- v7.3.6
- v7.3.7
- v7.3.8
- v7.3.9
- v7.4.0
- v7.4.0-BETA1
- v7.4.0-BETA2
- v7.4.0-RC1
- v7.4.1
- v7.4.3
- v7.4.4
- v7.4.5
- v7.4.6
- v7.4.7
- v7.4.8
- Affected ranges
- ECOSYSTEM: ≥ 7.0.0, < 7.4.13
Update to 7.4.13
symfony/http-foundation Packagist
- Versions
- v8.0.0
- v8.0.1
- v8.0.3
- v8.0.4
- v8.0.5
- v8.0.6
- v8.0.7
- v8.0.8
- Affected ranges
- ECOSYSTEM: ≥ 8.0.0, < 8.0.13
Update to 8.0.13
symfony/symfony Packagist
- Versions
- v5.4.0
- v5.4.1
- v5.4.10
- v5.4.11
- v5.4.12
- v5.4.13
- v5.4.14
- v5.4.15
- v5.4.16
- v5.4.17
- v5.4.18
- v5.4.19
- v5.4.2
- v5.4.20
- v5.4.21
- v5.4.22
- v5.4.23
- v5.4.24
- v5.4.25
- v5.4.26
- v5.4.27
- v5.4.28
- v5.4.29
- v5.4.3
- v5.4.30
- v5.4.31
- v5.4.32
- v5.4.33
- v5.4.34
- v5.4.35
- v5.4.36
- v5.4.37
- v5.4.38
- v5.4.39
- v5.4.4
- v5.4.40
- v5.4.41
- v5.4.42
- v5.4.43
- v5.4.44
- v5.4.45
- v5.4.46
- v5.4.47
- v5.4.48
- v5.4.49
- v5.4.5
- v5.4.50
- v5.4.51
- v5.4.52
- v5.4.6
- v5.4.7
- v5.4.8
- v5.4.9
- Affected ranges
- ECOSYSTEM: ≥ 5.4.0, < 5.4.53
Update to 5.4.53
symfony/symfony Packagist
- Versions
- v6.4.0
- v6.4.1
- v6.4.10
- v6.4.11
- v6.4.12
- v6.4.13
- v6.4.14
- v6.4.15
- v6.4.16
- v6.4.17
- v6.4.18
- v6.4.19
- v6.4.2
- v6.4.20
- v6.4.21
- v6.4.22
- v6.4.23
- v6.4.24
- v6.4.25
- v6.4.26
- v6.4.27
- v6.4.28
- v6.4.29
- v6.4.3
- v6.4.30
- v6.4.31
- v6.4.32
- v6.4.33
- v6.4.34
- v6.4.35
- v6.4.36
- v6.4.37
- v6.4.38
- v6.4.39
- v6.4.4
- v6.4.40
- v6.4.5
- v6.4.6
- v6.4.7
- v6.4.8
- v6.4.9
- Affected ranges
- ECOSYSTEM: ≥ 6.4.0, < 6.4.41
Update to 6.4.41
symfony/symfony Packagist
- Versions
- v7.0.0
- v7.0.1
- v7.0.10
- v7.0.2
- v7.0.3
- v7.0.4
- v7.0.5
- v7.0.6
- v7.0.7
- v7.0.8
- v7.0.9
- v7.1.0
- v7.1.0-BETA1
- v7.1.0-RC1
- v7.1.1
- v7.1.10
- v7.1.11
- v7.1.2
- v7.1.3
- v7.1.4
- v7.1.5
- v7.1.6
- v7.1.7
- v7.1.8
- v7.1.9
- v7.2.0
- v7.2.0-BETA1
- v7.2.0-BETA2
- v7.2.0-RC1
- v7.2.1
- v7.2.2
- v7.2.3
- v7.2.4
- v7.2.5
- v7.2.6
- v7.2.7
- v7.2.8
- v7.2.9
- v7.3.0
- v7.3.0-BETA1
- v7.3.0-BETA2
- v7.3.0-RC1
- v7.3.1
- v7.3.10
- v7.3.11
- v7.3.2
- v7.3.3
- v7.3.4
- v7.3.5
- v7.3.6
- v7.3.7
- v7.3.8
- v7.3.9
- v7.4.0
- v7.4.0-BETA1
- v7.4.0-BETA2
- v7.4.0-RC1
- v7.4.0-RC2
- v7.4.0-RC3
- v7.4.1
- v7.4.10
- v7.4.11
- v7.4.12
- v7.4.2
- v7.4.3
- v7.4.4
- v7.4.5
- v7.4.6
- v7.4.7
- v7.4.8
- v7.4.9
- Affected ranges
- ECOSYSTEM: ≥ 7.0.0, < 7.4.13
Update to 7.4.13
symfony/symfony Packagist
- Versions
- v8.0.0
- v8.0.1
- v8.0.10
- v8.0.11
- v8.0.12
- v8.0.2
- v8.0.3
- v8.0.4
- v8.0.5
- v8.0.6
- v8.0.7
- v8.0.8
- v8.0.9
- Affected ranges
- ECOSYSTEM: ≥ 8.0.0, < 8.0.13
Update to 8.0.13
symfony Ubuntu:16.04:LTS
- Versions
- 2.7.1+dfsg-1
- 2.7.5+dfsg-1
- 2.7.9+dfsg-1
- 2.7.9+dfsg-1ubuntu2
- 2.7.10-0ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
symfony Ubuntu:Pro:18.04:LTS
- Versions
- 2.8.7+dfsg-1.3ubuntu1
- 3.4.3+dfsg-1ubuntu4
- 3.4.6+dfsg-1
- 3.4.6+dfsg-1ubuntu0.1
- 3.4.6+dfsg-1ubuntu0.1+esm1
- 3.4.6+dfsg-1ubuntu0.1+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
symfony Ubuntu:Pro:20.04:LTS
- Versions
- 4.3.4+dfsg-1ubuntu1
- 4.3.8+dfsg-1ubuntu1
- 4.3.8+dfsg-1ubuntu1+esm1
- 4.3.8+dfsg-1ubuntu1+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
symfony Ubuntu:Pro:22.04:LTS
- Versions
- 5.2.6+dfsg-1ubuntu7
- 5.4.4+dfsg-1ubuntu8
- 5.4.4+dfsg-1ubuntu8+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
symfony Ubuntu:Pro:24.04:LTS
- Versions
- 5.4.23+dfsg-1ubuntu1
- 5.4.35+dfsg-3ubuntu1
- 6.4.5+dfsg-3ubuntu2
- 6.4.5+dfsg-3ubuntu3
- 6.4.5+dfsg-3ubuntu3+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
symfony Ubuntu:25.10
- Versions
- 6.4.18+dfsg-1ubuntu1
- 6.4.21+dfsg-2
- 6.4.21+dfsg-2ubuntu1
- 6.4.24+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
symfony Ubuntu:26.10
- Versions
- 7.4.7+dfsg-1ubuntu1
- 7.4.9+dfsg-1ubuntu1
- 7.4.13+dfsg-2ubuntu1
- 7.4.14+dfsg-1ubuntu2
- 7.4.15+dfsg-2ubuntu2
- 7.4.16+dfsg-1ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
symfony Ubuntu:26.04:LTS
- Versions
- 6.4.24+dfsg-1
- 7.4.5+dfsg-1ubuntu1
- 7.4.6+dfsg-2ubuntu1
- 7.4.7+dfsg-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://github.com/symfony/symfony/security/advisories/GHSA-38cx-cq6f-5755
- https://github.com/symfony/symfony/commit/82765368cf74177c36613575182f168a2eb765b2
- https://github.com/symfony/symfony/commit/85b831555be8ea1f43bf01078afe87bc4c92f65e
- https://github.com/symfony/symfony/releases/tag/v5.4.53
- https://github.com/symfony/symfony/releases/tag/v6.4.41
- https://github.com/symfony/symfony/releases/tag/v7.4.13
- https://nvd.nist.gov/vuln/detail/CVE-2026-48736