CVE-2024-50342
Internal address and port enumeration allowed by NoPrivateNetworkHttpClient in symfony/http-client
symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the NoPrivateNetworkHttpClient, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. As of versions 5.4.46, 6.4.14, and 7.1.7 the NoPrivateNetworkHttpClient now filters blocked IPs earlier to prevent such leaks. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Internal address and port enumeration allowed by NoPrivateNetworkHttpClient in symfony/http-client
symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the NoPrivateNetworkHttpClient, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. As of versions 5.4.46, 6.4.14, and 7.1.7 the NoPrivateNetworkHttpClient now filters blocked IPs earlier to prevent such leaks. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2024-50342- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2024-3230
symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the NoPrivateNetworkHttpClient, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. As of versions 5.4.46, 6.4.14, and 7.1.7 the NoPrivateNetworkHttpClient now filters blocked IPs earlier to prevent such leaks. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
EUVD-2024-3230- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9c3x-r3wp-mgxm
Symfony allows internal address and port enumeration by NoPrivateNetworkHttpClient
Description
When using the NoPrivateNetworkHttpClient, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration.
Resolution
The NoPrivateNetworkHttpClient now filters blocked IPs earlier to prevent such leaks.
The fisrt patch for this issue is available here for branch 5.4.
The second one is available here for branch 5.4 also.
Credits
We would like to thank Linus Karlsson and Chris Smith for reporting the issue and Nicolas Grekas for providing the fix.
- Record
GHSA-9c3x-r3wp-mgxm- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
NVD
symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the NoPrivateNetworkHttpClient, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. As of versions 5.4.46, 6.4.14, and 7.1.7 the NoPrivateNetworkHttpClient now filters blocked IPs earlier to prevent such leaks. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2024-50342- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
Internal address and port enumeration allowed by NoPrivateNetworkHttpClient in symfony/http-client
symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the NoPrivateNetworkHttpClient, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. As of versions 5.4.46, 6.4.14, and 7.1.7 the NoPrivateNetworkHttpClient now filters blocked IPs earlier to prevent such leaks. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2024-50342- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-50342
symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the NoPrivateNetworkHttpClient, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. As of versions 5.4.46, 6.4.14, and 7.1.7 the NoPrivateNetworkHttpClient now filters blocked IPs earlier to prevent such leaks. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
DEBIAN-CVE-2024-50342- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-9c3x-r3wp-mgxm
Symfony allows internal address and port enumeration by NoPrivateNetworkHttpClient
Description
When using the NoPrivateNetworkHttpClient, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration.
Resolution
The NoPrivateNetworkHttpClient now filters blocked IPs earlier to prevent such leaks.
The fisrt patch for this issue is available here for branch 5.4.
The second one is available here for branch 5.4 also.
Credits
We would like to thank Linus Karlsson and Chris Smith for reporting the issue and Nicolas Grekas for providing the fix.
- Record
GHSA-9c3x-r3wp-mgxm- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-50342
symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the NoPrivateNetworkHttpClient, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. As of versions 5.4.46, 6.4.14, and 7.1.7 the NoPrivateNetworkHttpClient now filters blocked IPs earlier to prevent such leaks. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
UBUNTU-CVE-2024-50342- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1793214753 No score
TuxCare security update for symfony/http-client (1 CVE)
TuxCare rebuilt symfony/http-client to address 1 CVE. Fixed in v6.0.20-p1+tuxcare.
- Record
CLSA-2026-1793214753- Updated
- 2026-11-02
OSVUSN-7272-1 No score
symfony vulnerabilities
Soner Sayakci discovered that Symfony incorrectly handled cookie storage in the web cache. An attacker could possibly use this issue to obtain sensitive information and access unauthorized resources. (CVE-2022-24894)
Marco Squarcina discovered that Symfony incorrectly handled the storage of user session information. An attacker could possibly use this issue to perform a cross-site request forgery (CSRF) attack. (CVE-2022-24895)
Pierre Rudloff discovered that Symfony incorrectly checked HTML input. An attacker could possibly use this issue to perform cross site scripting. (CVE-2023-46734)
Vladimir Dusheyko discovered that Symfony incorrectly sanitized special input with a PHP directive in URL query strings. An attacker could possibly use this issue to expose sensitive information or cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-50340)
Oleg Andreyev, Antoine Makdessi, and Moritz Rauch discovered that Symfony incorrectly handled user authentication. An attacker could possibly use this issue to access unauthorized resources and expose sensitive information. This issue was only addressed in Ubuntu 24.04 LTS. (CVE-2024-50341, CVE-2024-51996)
Linus Karlsson and Chris Smith discovered that Symfony returned internal host information during host resolution. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 24.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-50342)
It was discovered that Symfony incorrectly parsed user input through regular expressions. An attacker could possibly use this issue to expose sensitive information. (CVE-2024-50343)
Sam Mush discovered that Symfony incorrectly parsed URIs with special characters. An attacker could possibly use this issue to perform phishing attacks. (CVE-2024-50345)
- Record
USN-7272-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
symfony/http-clientPackagist |
4.3.0 up to 5.4.47 | 5.4.47 |
symfony/http-clientPackagist |
6.0.0 up to 6.4.15 | 6.4.15 |
symfony/http-clientPackagist |
7.0.0 up to 7.1.8 | 7.1.8 |
symfony/symfonyPackagist |
4.3.0 up to 5.4.47 | 5.4.47 |
symfony/symfonyPackagist |
6.0.0 up to 6.4.15 | 6.4.15 |
symfony/symfonyPackagist |
7.0.0 up to 7.1.8 | 7.1.8 |
symfony/http-clientTuxCare:Packagist |
v6.0.20 up to v6.0.20-p1+tuxcare | v6.0.20-p1+tuxcare |
symfonyDebian:12 |
before 5.4.23+dfsg-1+deb12u3, plus listed versions 5.4.23+dfsg-15.4.23+dfsg-1+deb12u15.4.23+dfsg-1+deb12u2 |
5.4.23+dfsg-1+deb12u3 |
symfonyDebian:13 |
before 6.4.15+dfsg-1 | 6.4.15+dfsg-1 |
symfonyDebian:14 |
before 6.4.15+dfsg-1 | 6.4.15+dfsg-1 |
Show 15 moreShow less
| Package | Affected | Fixed |
|---|---|---|
symfonyDebian:12 From an advisory covering 4 CVEs |
before 5.4.23+dfsg-1+deb12u3, plus listed versions 5.4.23+dfsg-15.4.23+dfsg-1+deb12u15.4.23+dfsg-1+deb12u2 |
5.4.23+dfsg-1+deb12u3 |
symfony/http-clientPackagist |
4.3.0 up to 5.4.47, plus listed versions v4.3.0v4.3.1v4.3.10v4.3.11v4.3.2 Show 45 moreShow lessv4.3.3v4.3.4v4.3.5v4.3.6v4.3.7v4.3.8v4.3.9v4.4.0v4.4.0-BETA1v4.4.0-BETA2v4.4.0-RC1v4.4.1v4.4.10v4.4.11v4.4.12v4.4.13v4.4.14v4.4.15v4.4.16v4.4.17v4.4.18v4.4.19v4.4.2v4.4.20v4.4.21v4.4.22v4.4.23v4.4.24v4.4.25v4.4.26v4.4.27v4.4.3v4.4.31v4.4.33v4.4.34v4.4.35v4.4.36v4.4.37v4.4.38v4.4.39v4.4.4v4.4.40v4.4.41v4.4.42v4.4.44 |
5.4.47 |
symfony/http-clientPackagist |
6.0.0 up to 6.4.15, plus listed versions v6.0.0v6.0.1v6.0.11v6.0.12v6.0.13 Show 45 moreShow lessv6.0.14v6.0.15v6.0.16v6.0.17v6.0.19v6.0.2v6.0.20v6.0.3v6.0.5v6.0.7v6.0.8v6.0.9v6.1.0v6.1.0-BETA1v6.1.0-BETA2v6.1.0-RC1v6.1.1v6.1.11v6.1.12v6.1.2v6.1.3v6.1.4v6.1.5v6.1.6v6.1.7v6.1.8v6.1.9v6.2.0v6.2.0-BETA1v6.2.0-BETA2v6.2.0-BETA3v6.2.0-RC1v6.2.10v6.2.11v6.2.12v6.2.13v6.2.2v6.2.5v6.2.6v6.2.7v6.2.8v6.2.9v6.3.0v6.3.0-BETA1v6.3.0-BETA2 |
6.4.15 |
symfony/http-clientPackagist |
7.0.0 up to 7.1.8, plus listed versions v7.0.0v7.0.10v7.0.2v7.0.3v7.0.4 Show 15 moreShow lessv7.0.5v7.0.6v7.0.7v7.0.8v7.0.9v7.1.0v7.1.0-BETA1v7.1.0-RC1v7.1.1v7.1.2v7.1.3v7.1.4v7.1.5v7.1.6v7.1.7 |
7.1.8 |
symfony/symfonyPackagist |
4.3.0 up to 5.4.47, plus listed versions v4.3.0v4.3.1v4.3.10v4.3.11v4.3.2 Show 45 moreShow lessv4.3.3v4.3.4v4.3.5v4.3.6v4.3.7v4.3.8v4.3.9v4.4.0v4.4.0-BETA1v4.4.0-BETA2v4.4.0-RC1v4.4.1v4.4.10v4.4.11v4.4.12v4.4.13v4.4.14v4.4.15v4.4.16v4.4.17v4.4.18v4.4.19v4.4.2v4.4.20v4.4.21v4.4.22v4.4.23v4.4.24v4.4.25v4.4.26v4.4.27v4.4.28v4.4.29v4.4.3v4.4.30v4.4.31v4.4.32v4.4.33v4.4.34v4.4.35v4.4.36v4.4.37v4.4.38v4.4.39v4.4.4 |
5.4.47 |
symfony/symfonyPackagist |
6.0.0 up to 6.4.15, plus listed versions v6.0.0v6.0.1v6.0.10v6.0.11v6.0.12 Show 45 moreShow lessv6.0.13v6.0.14v6.0.15v6.0.16v6.0.17v6.0.18v6.0.19v6.0.2v6.0.20v6.0.3v6.0.4v6.0.5v6.0.6v6.0.7v6.0.8v6.0.9v6.1.0v6.1.0-BETA1v6.1.0-BETA2v6.1.0-RC1v6.1.1v6.1.10v6.1.11v6.1.12v6.1.2v6.1.3v6.1.4v6.1.5v6.1.6v6.1.7v6.1.8v6.1.9v6.2.0v6.2.0-BETA1v6.2.0-BETA2v6.2.0-BETA3v6.2.0-RC1v6.2.0-RC2v6.2.1v6.2.10v6.2.11v6.2.12v6.2.13v6.2.14v6.2.2 |
6.4.15 |
symfony/symfonyPackagist |
7.0.0 up to 7.1.8, plus listed versions v7.0.0v7.0.1v7.0.10v7.0.2v7.0.3 Show 16 moreShow lessv7.0.4v7.0.5v7.0.6v7.0.7v7.0.8v7.0.9v7.1.0v7.1.0-BETA1v7.1.0-RC1v7.1.1v7.1.2v7.1.3v7.1.4v7.1.5v7.1.6v7.1.7 |
7.1.8 |
symfonyUbuntu:Pro:22.04:LTS |
before 5.4.4+dfsg-1ubuntu8+esm1, plus listed versions 5.2.6+dfsg-1ubuntu75.4.4+dfsg-1ubuntu8 |
5.4.4+dfsg-1ubuntu8+esm1 |
symfonyUbuntu:Pro:24.04:LTS |
before 6.4.5+dfsg-3ubuntu3+esm1, plus listed versions 5.4.23+dfsg-1ubuntu15.4.35+dfsg-3ubuntu16.4.5+dfsg-3ubuntu26.4.5+dfsg-3ubuntu3 |
6.4.5+dfsg-3ubuntu3+esm1 |
symfonyUbuntu:25.10 |
All versions, plus listed versions 6.4.18+dfsg-1ubuntu16.4.21+dfsg-26.4.21+dfsg-2ubuntu16.4.24+dfsg-1 |
None known |
symfonyUbuntu:26.10 |
All versions, plus listed versions 7.4.7+dfsg-1ubuntu17.4.9+dfsg-1ubuntu17.4.13+dfsg-2ubuntu17.4.14+dfsg-1ubuntu27.4.15+dfsg-2ubuntu27.4.16+dfsg-1ubuntu2 |
None known |
symfonyUbuntu:26.04:LTS |
All versions, plus listed versions 6.4.24+dfsg-17.4.5+dfsg-1ubuntu17.4.6+dfsg-2ubuntu17.4.7+dfsg-1ubuntu1 |
None known |
symfonyUbuntu:Pro:20.04:LTS From an advisory covering 9 CVEs |
before 4.3.8+dfsg-1ubuntu1+esm2, plus listed versions 4.3.4+dfsg-1ubuntu14.3.8+dfsg-1ubuntu14.3.8+dfsg-1ubuntu1+esm1 |
4.3.8+dfsg-1ubuntu1+esm2 |
symfonyUbuntu:Pro:22.04:LTS From an advisory covering 9 CVEs |
before 5.4.4+dfsg-1ubuntu8+esm1, plus listed versions 5.2.6+dfsg-1ubuntu75.4.4+dfsg-1ubuntu8 |
5.4.4+dfsg-1ubuntu8+esm1 |
symfonyUbuntu:Pro:24.04:LTS From an advisory covering 9 CVEs |
before 6.4.5+dfsg-3ubuntu3+esm1, plus listed versions 5.4.23+dfsg-1ubuntu15.4.35+dfsg-3ubuntu16.4.5+dfsg-3ubuntu26.4.5+dfsg-3ubuntu3 |
6.4.5+dfsg-3ubuntu3+esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-50342 is a low vulnerability (CVSS 3.1) in Sensiolabs Httpclient, published November 6, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. Fixed in symfony/http-client 5.4.47.
References
github.com/symfony/symfony/security/advisories/GHSA-9c3x-r3wp-mgxm
symfony.com/cve-2024-50342
nvd.nist.gov/vuln/detail/CVE-2024-50342
Show 16 moreShow less
security-tracker.debian.org/tracker/CVE-2024-50342
ubuntu.com/security/CVE-2024-50342
cve.org/CVERecord?id=CVE-2024-50342
Left out here: 326 versions. The JSON record has them.