CVE-2026-123125

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 5.4.56 Symfony versions prior to 6.4.50 Symfony versions prior to 7.4.23 Symfony versions prior to 8.1.11

Description The IpValidator in the Symfony Validator component incorrectly classifies certain internal addresses as public when using filtered modes of the Ip constraint. This occurs because the validator relies on PHP flags FILTER FLAG NO PRIV RANGE and FILTER FLAG NO RES RANGE, which fail to account for shared address space (100.64.0.0/10) and specific IPv6 formats, such as IPv4-mapped, IPv4-compatible, and 6to4 addresses. Consequently, an internal address like ::ffff:127.0.0.1 may pass validation. This flaw can lead to Server-Side Request Forgery (SSRF), a condition where an attacker induces the server to make requests to an internal resource.

Recommendations Update to version 5.4.56 or later. Update to version 6.4.50 or later. Update to version 7.4.23 or later. Update to version 8.1.11 or later.