Is CVE-2026-121619 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121619 being exploited in the wild.

How severe is CVE-2026-121619?

Informational severity, published 12 November 2026.

Which products and versions are affected?

Symfony FrameworkBundle 7.1 prior to 7.4.23; 8.x prior to 8.1.11; Symfony HttpFoundation 7.2 prior to 7.4.23; 8.x prior to 8.1.11.

How is CVE-2026-121619 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-121619?

Check whether you run Symfony FrameworkBundle or Symfony HttpFoundation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121619: Symfony FrameworkBundle IP spoofing via trusted_proxies

CVE-2026-121619 · Severity: info · Published 2026-11-12

Symfony's trusted proxy configuration can be abused to spoof client IP addresses, hostnames, and connection schemes when using the "private_ranges" shortcut. An attacker can forge X-Forwarded-* headers to bypass IP-based access controls, poison password reset emails, or bypass HTTPS enforcement, affecting web applications that rely on this configuration for reverse proxy support.

Vendors: Symfony.

Quick answers

Is CVE-2026-121619 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121619 being exploited in the wild.
How severe is CVE-2026-121619?: Informational severity, published 12 November 2026.
Which products and versions are affected?: Symfony FrameworkBundle 7.1 prior to 7.4.23; 8.x prior to 8.1.11; Symfony HttpFoundation 7.2 prior to 7.4.23; 8.x prior to 8.1.11.
Is there a fix for CVE-2026-121619?: Yes: fixed in FrameworkBundle 7.4.23, 8.1.11; HttpFoundation 7.4.23, 8.1.11. Until then: Do not use the private_ranges shortcut with trusted_proxies configuration; instead explicitly list the IP address ranges of your legitimate reverse proxies. Applications on Symfony 6.4 are unaffected by default unless they explicitly pass IpUtils::PRIVATE_SUBNETS to Request::setTrustedProxies(). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121619 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-121619?: Check whether you run Symfony FrameworkBundle or Symfony HttpFoundation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: FrameworkBundle 7.4.23, 8.1.11; HttpFoundation 7.4.23, 8.1.11

Do not use the private_ranges shortcut with trusted_proxies configuration; instead explicitly list the IP address ranges of your legitimate reverse proxies. Applications on Symfony 6.4 are unaffected by default unless they explicitly pass IpUtils::PRIVATE_SUBNETS to Request::setTrustedProxies().

Technical details

The private_ranges keyword in framework.trusted_proxies and Request::setTrustedProxies() mistakenly includes IPv6 prefixes that embed IPv4 addresses (IPv4-mapped, 6to4, Teredo, NAT64). Remote attackers can connect using these source addresses and have their X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Proto headers trusted as if they were behind a legitimate reverse proxy. Vulnerable deployments include IPv6 servers without IPV6_V6ONLY set (exposing all IPv4 clients) and servers accessible over globally-routed IPv6 (6to4/Teredo space).

Affected products

Symfony FrameworkBundle 7.1 prior to 7.4.23; 8.x prior to 8.1.11
Symfony HttpFoundation 7.2 prior to 7.4.23; 8.x prior to 8.1.11

Timeline

2026-11-12: disclosed
2026-11-12: patched: Fixed in 7.4.23 and 8.1.11

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.