CVE-2026-48736

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 5.4.31 Symfony versions prior to 6.4.11

Description SymfonyComponentHttpClientNoPrivateNetworkHttpClient is a decorator designed to block requests to private networks. However, the list of blocked subnets omits several IPv6 transition forms that can embed private IPv4 destinations, including 6to4, Teredo, NAT64, and IPv4-compatible IPv6. Because the IpUtils::checkIp6() function performs a bitwise CIDR comparison without extracting the embedded IPv4 address, an attacker providing a specially crafted URL can bypass the security boundary. This allows the NoPrivateNetworkHttpClient to dispatch requests to internal targets, such as loopback or RFC1918 IPv4 addresses, by using IPv6 representations.

Recommendations Update to version 5.4.31 or later. Update to version 6.4.11 or later.