{"id":"CVE-2026-48736","aliases":["DEBIAN-CVE-2026-48736","EUVD-2026-44372","GHSA-38cx-cq6f-5755","UBUNTU-CVE-2026-48736"],"status":"published","title":"Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient","description":"Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6, allowing attacker-supplied URLs to represent private IPv4 targets in forms that IpUtils::isPrivateIp() did not block. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0057,"percentile":0.47494,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-184","CWE-918"],"published":"2026-06-15T17:31:28Z","modified":"2026-10-28T02:30:25Z","fixes":[{"ecosystem":"Packagist","package":"symfony/http-client","fixed_in":["5.4.53"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"symfony/http-foundation","fixed_in":["6.4.41","7.4.13","8.0.13"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"symfony/symfony","fixed_in":["5.4.53","6.4.41","7.4.13","8.0.13"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"symfony","fixed_in":["5.4.53+dfsg-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"symfony","fixed_in":["6.4.41+dfsg-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"symfony","fixed_in":["7.4.13+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"symfony/http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.0"},{"fixed":"5.4.53"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"symfony/http-foundation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.0"},{"fixed":"6.4.41"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"symfony/http-foundation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.4.13"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"symfony/http-foundation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.13"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.0"},{"fixed":"5.4.53"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.0"},{"fixed":"6.4.41"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.4.13"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.13"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.53+dfsg-0+deb12u1"}]}],"versions":["5.4.23+dfsg-1","5.4.23+dfsg-1+deb12u1","5.4.23+dfsg-1+deb12u2","5.4.23+dfsg-1+deb12u3","5.4.23+dfsg-1+deb12u4","5.4.23+dfsg-1+deb12u5","5.4.24+dfsg-1","5.4.25+dfsg-1","5.4.27+dfsg-1","5.4.28+dfsg-1","5.4.29+dfsg-1","5.4.30+dfsg-1","5.4.31+dfsg-1","5.4.31+dfsg-2","5.4.32+dfsg-1","5.4.33+dfsg-1","5.4.34+dfsg-1","5.4.34+dfsg-2","5.4.35+dfsg-1","5.4.35+dfsg-2","5.4.35+dfsg-3","5.4.52+dfsg-0+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.41+dfsg-0+deb13u1"}]}],"versions":["6.4.21+dfsg-2","6.4.21+dfsg-2+deb13u1","6.4.24+dfsg-1","6.4.25+dfsg-1","6.4.40+dfsg-0+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.13+dfsg-1"}]}],"versions":["6.4.21+dfsg-2","6.4.24+dfsg-1","6.4.25+dfsg-1","7.0.4+dfsg-1","7.0.5+dfsg-1","7.0.6+dfsg-1","7.0.7+dfsg-1","7.1.0~beta1+dfsg-1","7.1.0~rc1+dfsg-1","7.1.2+dfsg-1","7.1.3+dfsg-1","7.1.4+dfsg-1","7.1.5+dfsg-1","7.2.0~beta1+dfsg-1","7.2.0~beta2+dfsg-1","7.2.0~rc1+dfsg-1","7.2.1+dfsg-1","7.2.2+dfsg-1","7.2.3+dfsg-1","7.2.4+dfsg-1","7.2.5+dfsg-1","7.2.6-1","7.3.0+dfsg-1","7.3.0~beta1+dfsg-1","7.3.0~beta2+dfsg-1","7.3.0~rc1+dfsg-1","7.3.1+dfsg-1","7.3.2+dfsg-1","7.3.3+dfsg-1","7.3.4+dfsg-1","7.3.5-1","7.4.0+dfsg-1","7.4.0+dfsg-2","7.4.0~beta1-1","7.4.0~beta1-2","7.4.0~beta2+dfsg-1","7.4.0~beta2+dfsg-2","7.4.0~beta2+dfsg-3","7.4.0~rc1+dfsg-1","7.4.0~rc2+dfsg-1","7.4.0~rc3+dfsg-1","7.4.10+dfsg-1","7.4.12+dfsg-1","7.4.2+dfsg-1","7.4.2+dfsg-2","7.4.3+dfsg-1","7.4.4+dfsg-1","7.4.5+dfsg-1","7.4.6+dfsg-1","7.4.6+dfsg-2","7.4.7+dfsg-1","7.4.8+dfsg-1","7.4.9+dfsg-1"]},{"source":"osv","ecosystem":"Packagist","package":"symfony/http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.0"},{"fixed":"5.4.53"}]}],"versions":["v5.4.0","v5.4.1","v5.4.11","v5.4.12","v5.4.13","v5.4.14","v5.4.15","v5.4.16","v5.4.17","v5.4.19","v5.4.2","v5.4.20","v5.4.21","v5.4.22","v5.4.23","v5.4.24","v5.4.25","v5.4.26","v5.4.29","v5.4.3","v5.4.31","v5.4.34","v5.4.35","v5.4.36","v5.4.37","v5.4.38","v5.4.39","v5.4.40","v5.4.41","v5.4.42","v5.4.43","v5.4.44","v5.4.45","v5.4.46","v5.4.47","v5.4.48","v5.4.49","v5.4.5","v5.4.7","v5.4.8","v5.4.9"]},{"source":"osv","ecosystem":"Packagist","package":"symfony/http-foundation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.0"},{"fixed":"6.4.41"}]}],"versions":["v6.4.0","v6.4.10","v6.4.12","v6.4.13","v6.4.14","v6.4.15","v6.4.16","v6.4.18","v6.4.2","v6.4.21","v6.4.22","v6.4.23","v6.4.24","v6.4.25","v6.4.26","v6.4.28","v6.4.29","v6.4.3","v6.4.30","v6.4.31","v6.4.32","v6.4.33","v6.4.34","v6.4.35","v6.4.4","v6.4.7","v6.4.8"]},{"source":"osv","ecosystem":"Packagist","package":"symfony/http-foundation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.4.13"}]}],"versions":["v7.0.0","v7.0.10","v7.0.3","v7.0.4","v7.0.6","v7.0.7","v7.0.8","v7.1.0","v7.1.0-BETA1","v7.1.0-RC1","v7.1.1","v7.1.10","v7.1.11","v7.1.3","v7.1.5","v7.1.6","v7.1.7","v7.1.8","v7.1.9","v7.2.0","v7.2.0-BETA1","v7.2.0-BETA2","v7.2.0-RC1","v7.2.2","v7.2.3","v7.2.5","v7.2.6","v7.2.7","v7.2.8","v7.2.9","v7.3.0","v7.3.0-BETA1","v7.3.0-BETA2","v7.3.0-RC1","v7.3.1","v7.3.10","v7.3.11","v7.3.2","v7.3.3","v7.3.4","v7.3.5","v7.3.6","v7.3.7","v7.3.8","v7.3.9","v7.4.0","v7.4.0-BETA1","v7.4.0-BETA2","v7.4.0-RC1","v7.4.1","v7.4.3","v7.4.4","v7.4.5","v7.4.6","v7.4.7","v7.4.8"]},{"source":"osv","ecosystem":"Packagist","package":"symfony/http-foundation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.13"}]}],"versions":["v8.0.0","v8.0.1","v8.0.3","v8.0.4","v8.0.5","v8.0.6","v8.0.7","v8.0.8"]},{"source":"osv","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.0"},{"fixed":"5.4.53"}]}],"versions":["v5.4.0","v5.4.1","v5.4.10","v5.4.11","v5.4.12","v5.4.13","v5.4.14","v5.4.15","v5.4.16","v5.4.17","v5.4.18","v5.4.19","v5.4.2","v5.4.20","v5.4.21","v5.4.22","v5.4.23","v5.4.24","v5.4.25","v5.4.26","v5.4.27","v5.4.28","v5.4.29","v5.4.3","v5.4.30","v5.4.31","v5.4.32","v5.4.33","v5.4.34","v5.4.35","v5.4.36","v5.4.37","v5.4.38","v5.4.39","v5.4.4","v5.4.40","v5.4.41","v5.4.42","v5.4.43","v5.4.44","v5.4.45","v5.4.46","v5.4.47","v5.4.48","v5.4.49","v5.4.5","v5.4.50","v5.4.51","v5.4.52","v5.4.6","v5.4.7","v5.4.8","v5.4.9"]},{"source":"osv","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.0"},{"fixed":"6.4.41"}]}],"versions":["v6.4.0","v6.4.1","v6.4.10","v6.4.11","v6.4.12","v6.4.13","v6.4.14","v6.4.15","v6.4.16","v6.4.17","v6.4.18","v6.4.19","v6.4.2","v6.4.20","v6.4.21","v6.4.22","v6.4.23","v6.4.24","v6.4.25","v6.4.26","v6.4.27","v6.4.28","v6.4.29","v6.4.3","v6.4.30","v6.4.31","v6.4.32","v6.4.33","v6.4.34","v6.4.35","v6.4.36","v6.4.37","v6.4.38","v6.4.39","v6.4.4","v6.4.40","v6.4.5","v6.4.6","v6.4.7","v6.4.8","v6.4.9"]},{"source":"osv","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.4.13"}]}],"versions":["v7.0.0","v7.0.1","v7.0.10","v7.0.2","v7.0.3","v7.0.4","v7.0.5","v7.0.6","v7.0.7","v7.0.8","v7.0.9","v7.1.0","v7.1.0-BETA1","v7.1.0-RC1","v7.1.1","v7.1.10","v7.1.11","v7.1.2","v7.1.3","v7.1.4","v7.1.5","v7.1.6","v7.1.7","v7.1.8","v7.1.9","v7.2.0","v7.2.0-BETA1","v7.2.0-BETA2","v7.2.0-RC1","v7.2.1","v7.2.2","v7.2.3","v7.2.4","v7.2.5","v7.2.6","v7.2.7","v7.2.8","v7.2.9","v7.3.0","v7.3.0-BETA1","v7.3.0-BETA2","v7.3.0-RC1","v7.3.1","v7.3.10","v7.3.11","v7.3.2","v7.3.3","v7.3.4","v7.3.5","v7.3.6","v7.3.7","v7.3.8","v7.3.9","v7.4.0","v7.4.0-BETA1","v7.4.0-BETA2","v7.4.0-RC1","v7.4.0-RC2","v7.4.0-RC3","v7.4.1","v7.4.10","v7.4.11","v7.4.12","v7.4.2","v7.4.3","v7.4.4","v7.4.5","v7.4.6","v7.4.7","v7.4.8","v7.4.9"]},{"source":"osv","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.13"}]}],"versions":["v8.0.0","v8.0.1","v8.0.10","v8.0.11","v8.0.12","v8.0.2","v8.0.3","v8.0.4","v8.0.5","v8.0.6","v8.0.7","v8.0.8","v8.0.9"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.1+dfsg-1","2.7.5+dfsg-1","2.7.9+dfsg-1","2.7.9+dfsg-1ubuntu2","2.7.10-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.7+dfsg-1.3ubuntu1","3.4.3+dfsg-1ubuntu4","3.4.6+dfsg-1","3.4.6+dfsg-1ubuntu0.1","3.4.6+dfsg-1ubuntu0.1+esm1","3.4.6+dfsg-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.4+dfsg-1ubuntu1","4.3.8+dfsg-1ubuntu1","4.3.8+dfsg-1ubuntu1+esm1","4.3.8+dfsg-1ubuntu1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.6+dfsg-1ubuntu7","5.4.4+dfsg-1ubuntu8","5.4.4+dfsg-1ubuntu8+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.23+dfsg-1ubuntu1","5.4.35+dfsg-3ubuntu1","6.4.5+dfsg-3ubuntu2","6.4.5+dfsg-3ubuntu3","6.4.5+dfsg-3ubuntu3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.18+dfsg-1ubuntu1","6.4.21+dfsg-2","6.4.21+dfsg-2ubuntu1","6.4.24+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.4.7+dfsg-1ubuntu1","7.4.9+dfsg-1ubuntu1","7.4.13+dfsg-2ubuntu1","7.4.14+dfsg-1ubuntu2","7.4.15+dfsg-2ubuntu2","7.4.16+dfsg-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.24+dfsg-1","7.4.5+dfsg-1ubuntu1","7.4.6+dfsg-2ubuntu1","7.4.7+dfsg-1ubuntu1"]}],"products":[{"vendor":"actions","product":"http-client"},{"vendor":"sensiolabs","product":"symfony"},{"vendor":"symfony","product":"http-client"},{"vendor":"symfony","product":"http-foundation"},{"vendor":"symfony","product":"symfony"}],"references":[{"url":"https://github.com/symfony/symfony/security/advisories/GHSA-38cx-cq6f-5755","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/symfony/symfony/commit/82765368cf74177c36613575182f168a2eb765b2","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/symfony/symfony/commit/85b831555be8ea1f43bf01078afe87bc4c92f65e","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/symfony/symfony/releases/tag/v5.4.53","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/symfony/symfony/releases/tag/v6.4.41","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/symfony/symfony/releases/tag/v7.4.13","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-client/CVE-2026-48736.yaml","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2026-48736.yaml","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-48736.yaml","tags":["web"]},{"url":"https://symfony.com/cve-2026-48736","tags":["web"]},{"url":"https://github.com/advisories/GHSA-38cx-cq6f-5755"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48736.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48736","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-48736","tags":["advisory"]},{"url":"https://github.com/symfony/symfony","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-48736","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48736","tags":["report"]},{"url":"https://symfony.com/blog/cve-2026-48736-iputils-private-subnets-omits-ipv6-transition-forms-ssrf-bypass-in-noprivatenetworkhttpclient","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-48736","title":"Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient","description":"Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6, allowing attacker-supplied URLs to represent private IPv4 targets in forms that IpUtils::isPrivateIp() did not block. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.","status":"published","published":"2026-07-14T19:09:30.26Z","modified":"2026-07-15T13:23:06.394Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-184","CWE-918"],"updated_at":"2026-11-02T14:19:47.998488Z"}],"euvd":[{"id":"EUVD-2026-44372","description":"Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6, allowing attacker-supplied URLs to represent private IPv4 targets in forms that IpUtils::isPrivateIp() did not block. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.","status":"published","published":"2026-07-14T19:09:30Z","modified":"2026-07-15T13:23:06Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:19:53.226345Z"}],"ghsa":[{"id":"GHSA-38cx-cq6f-5755","title":"Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient","description":"### Description\n\n`Symfony\\Component\\HttpClient\\NoPrivateNetworkHttpClient` is documented as a decorator that blocks requests to private networks by default. The list of blocked subnets (`Symfony\\Component\\HttpFoundation\\IpUtils::PRIVATE_SUBNETS` on 6.4+, a private constant in `NoPrivateNetworkHttpClient` on 5.4) enumerates RFC1918, loopback, link-local and IPv4-mapped IPv6 (`::ffff:0:0/96`) prefixes, but omits the remaining IPv6 transition forms that can embed a private IPv4 destination: 6to4 (`2002::/16`, RFC 3056), Teredo (`2001::/32`, RFC 4380), NAT64 (`64:ff9b::/96`, RFC 6052 and `64:ff9b:1::/48`, RFC 8215) and IPv4-compatible IPv6 (`::/96`, RFC 4291 §2.5.5.1).\n\n`IpUtils::checkIp6()` is a pure bitwise CIDR comparison against the constants list and never extracts the embedded IPv4, so an attacker who can supply a URL writes the loopback / RFC1918 IPv4 target as e.g. `http://[2002:7f00:1::]/` (6to4 → 127.0.0.1), `http://[64:ff9b::7f00:1]/` (NAT64 → 127.0.0.1), `http://[::7f00:1]/` (IPv4-compatible → 127.0.0.1) or `http://[2001::1]/` (Teredo). `IpUtils::isPrivateIp()` returns `false` and `NoPrivateNetworkHttpClient` dispatches the request.\n\nReal-world reachability of the embedded IPv4 depends on the deploy's IPv6 routing (6to4 tunnel interface, upstream NAT64 gateway, kernel handling of IPv4-compatible addresses), but the security boundary the decorator promises — the dispatch decision — is crossed regardless of whether the packet ultimately lands on the embedded IPv4.\n\n### Resolution\n\nThe private-subnet list now includes `::/96`, `2002::/16`, `2001::/32`, `64:ff9b::/96` and `64:ff9b:1::/48`. Blanket blocking of these prefixes matches the policy applied by Chromium and Mozilla's Private Network Access; server-side HTTPS APIs are not legitimately published on these prefixes.\n\nThe patches for this issue are available [here](https://github.com/symfony/symfony/commit/82765368cf74177c36613575182f168a2eb765b2) for branch 5.4 and [here](https://github.com/symfony/symfony/commit/85b831555be8ea1f43bf01078afe87bc4c92f65e) for branch 6.4 (and forward-ported to 7.4, 8.0 and 8.1).\n\n### Credits\n\nSymfony would like to thank tonghuaroot for reporting the issue and Nicolas Grekas for providing the fix.","status":"published","published":"2026-06-15T17:31:28Z","modified":"2026-06-15T17:31:29Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-184","CWE-918"],"updated_at":"2026-11-02T14:40:27.329706Z"}],"nvd":[{"id":"CVE-2026-48736","description":"Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6, allowing attacker-supplied URLs to represent private IPv4 targets in forms that IpUtils::isPrivateIp() did not block. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.","status":"published","published":"2026-07-14T20:17:09.943Z","modified":"2026-07-16T03:12:24.813Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-184","CWE-918"],"updated_at":"2026-11-02T14:12:29.879716Z"}],"osv":[{"id":"CVE-2026-48736","title":"Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient","description":"Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6, allowing attacker-supplied URLs to represent private IPv4 targets in forms that IpUtils::isPrivateIp() did not block. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.","status":"published","published":"2026-07-14T19:09:30.26Z","modified":"2026-10-28T02:30:25.511188962Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N","level":"medium"}],"cwes":["CWE-184","CWE-918"],"updated_at":"2026-11-02T15:45:06.701612Z"},{"id":"DEBIAN-CVE-2026-48736","description":"Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6, allowing attacker-supplied URLs to represent private IPv4 targets in forms that IpUtils::isPrivateIp() did not block. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.","status":"published","published":"2026-07-14T20:17:09.943Z","modified":"2026-10-01T03:03:16.112179059Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:56.444225Z"},{"id":"GHSA-38cx-cq6f-5755","title":"Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient","description":"### Description\n\n`Symfony\\Component\\HttpClient\\NoPrivateNetworkHttpClient` is documented as a decorator that blocks requests to private networks by default. The list of blocked subnets (`Symfony\\Component\\HttpFoundation\\IpUtils::PRIVATE_SUBNETS` on 6.4+, a private constant in `NoPrivateNetworkHttpClient` on 5.4) enumerates RFC1918, loopback, link-local and IPv4-mapped IPv6 (`::ffff:0:0/96`) prefixes, but omits the remaining IPv6 transition forms that can embed a private IPv4 destination: 6to4 (`2002::/16`, RFC 3056), Teredo (`2001::/32`, RFC 4380), NAT64 (`64:ff9b::/96`, RFC 6052 and `64:ff9b:1::/48`, RFC 8215) and IPv4-compatible IPv6 (`::/96`, RFC 4291 §2.5.5.1).\n\n`IpUtils::checkIp6()` is a pure bitwise CIDR comparison against the constants list and never extracts the embedded IPv4, so an attacker who can supply a URL writes the loopback / RFC1918 IPv4 target as e.g. `http://[2002:7f00:1::]/` (6to4 → 127.0.0.1), `http://[64:ff9b::7f00:1]/` (NAT64 → 127.0.0.1), `http://[::7f00:1]/` (IPv4-compatible → 127.0.0.1) or `http://[2001::1]/` (Teredo). `IpUtils::isPrivateIp()` returns `false` and `NoPrivateNetworkHttpClient` dispatches the request.\n\nReal-world reachability of the embedded IPv4 depends on the deploy's IPv6 routing (6to4 tunnel interface, upstream NAT64 gateway, kernel handling of IPv4-compatible addresses), but the security boundary the decorator promises — the dispatch decision — is crossed regardless of whether the packet ultimately lands on the embedded IPv4.\n\n### Resolution\n\nThe private-subnet list now includes `::/96`, `2002::/16`, `2001::/32`, `64:ff9b::/96` and `64:ff9b:1::/48`. Blanket blocking of these prefixes matches the policy applied by Chromium and Mozilla's Private Network Access; server-side HTTPS APIs are not legitimately published on these prefixes.\n\nThe patches for this issue are available [here](https://github.com/symfony/symfony/commit/82765368cf74177c36613575182f168a2eb765b2) for branch 5.4 and [here](https://github.com/symfony/symfony/commit/85b831555be8ea1f43bf01078afe87bc4c92f65e) for branch 6.4 (and forward-ported to 7.4, 8.0 and 8.1).\n\n### Credits\n\nSymfony would like to thank tonghuaroot for reporting the issue and Nicolas Grekas for providing the fix.","status":"published","published":"2026-06-15T17:31:28Z","modified":"2026-09-10T03:51:07.91492383Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-184","CWE-918"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"UBUNTU-CVE-2026-48736","description":"Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6, allowing attacker-supplied URLs to represent private IPv4 targets in forms that IpUtils::isPrivateIp() did not block. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.","status":"published","published":"2026-07-14T20:17:00Z","modified":"2026-10-17T13:00:24.210338241Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N","level":"medium"},{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:33.391918Z"}]}}