CVE-2026-123119

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 5.4.56 Symfony versions 6.x prior to 6.4.50 Symfony versions 7.x prior to 7.4.23 Symfony versions 8.x prior to 8.1.11

Description The NoPrivateNetworkHttpClient in the Symfony HttpClient component fails to pin the checked IP address of cached hosts. This allows for DNS rebinding, a technique where a DNS server changes the IP address associated with a domain name between requests, to bypass private network restrictions. The component resolves the host and checks the IP before connecting, but it only passes the resolve option on the first lookup. On subsequent requests, the decorated client resolves the host independently. An attacker controlling the DNS can provide a public IP for the first request and a private IP for later requests, enabling the enumeration of internal hosts and ports. This occurs because the connection is established before the primary ip check in the on progress() callback aborts the request, and the resulting error varies based on whether the port is open or closed.

Recommendations Update to version 5.4.56 or later. Update to version 6.4.50 or later. Update to version 7.4.23 or later. Update to version 8.1.11 or later.