# CVE-2026-121619: Symfony FrameworkBundle IP spoofing via trusted_proxies

Source: https://junglewise.ai/threats/cve-2026-121619-the-symfony-frameworkbundle-framework-trusted-proxies-option-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-121619 · Severity: info · Published 2026-11-12

Symfony's trusted proxy configuration can be abused to spoof client IP addresses, hostnames, and connection schemes when using the "private_ranges" shortcut. An attacker can forge X-Forwarded-* headers to bypass IP-based access controls, poison password reset emails, or bypass HTTPS enforcement, affecting web applications that rely on this configuration for reverse proxy support.

Vendors: [Symfony](https://junglewise.ai/threats/vendors/symfony).

## Quick answers

**Is CVE-2026-121619 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121619 being exploited in the wild.

**How severe is CVE-2026-121619?** Informational severity, published 12 November 2026.

**Which products and versions are affected?** Symfony FrameworkBundle 7.1 prior to 7.4.23; 8.x prior to 8.1.11; Symfony HttpFoundation 7.2 prior to 7.4.23; 8.x prior to 8.1.11.

**Is there a fix for CVE-2026-121619?** Yes: fixed in FrameworkBundle 7.4.23, 8.1.11; HttpFoundation 7.4.23, 8.1.11. Until then: Do not use the private_ranges shortcut with trusted_proxies configuration; instead explicitly list the IP address ranges of your legitimate reverse proxies. Applications on Symfony 6.4 are unaffected by default unless they explicitly pass IpUtils::PRIVATE_SUBNETS to Request::setTrustedProxies(). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121619 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-121619?** Check whether you run Symfony FrameworkBundle or Symfony HttpFoundation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in FrameworkBundle 7.4.23, 8.1.11; HttpFoundation 7.4.23, 8.1.11

Do not use the private_ranges shortcut with trusted_proxies configuration; instead explicitly list the IP address ranges of your legitimate reverse proxies. Applications on Symfony 6.4 are unaffected by default unless they explicitly pass IpUtils::PRIVATE_SUBNETS to Request::setTrustedProxies().

## Technical details

The private_ranges keyword in framework.trusted_proxies and Request::setTrustedProxies() mistakenly includes IPv6 prefixes that embed IPv4 addresses (IPv4-mapped, 6to4, Teredo, NAT64). Remote attackers can connect using these source addresses and have their X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Proto headers trusted as if they were behind a legitimate reverse proxy. Vulnerable deployments include IPv6 servers without IPV6_V6ONLY set (exposing all IPv4 clients) and servers accessible over globally-routed IPv6 (6to4/Teredo space).

## Affected products

- Symfony FrameworkBundle 7.1 prior to 7.4.23; 8.x prior to 8.1.11
- Symfony HttpFoundation 7.2 prior to 7.4.23; 8.x prior to 8.1.11

## Timeline

- 2026-11-12: disclosed
- 2026-11-12: patched: Fixed in 7.4.23 and 8.1.11

## Related threats

- [Symfony SSRF bypass in NoPrivateNetworkHttpClient and IpUtils](https://junglewise.ai/threats/cve-2026-48736-symfony-ssrf-bypass-in-noprivatenetworkhttpclient-and-iputils)