Is CVE-2026-123119 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123119 being exploited in the wild.

How severe is CVE-2026-123119?

Informational severity, published 5 November 2026.

Which products and versions are affected?

Symfony HttpClient prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, 8.x prior to 8.1.11.

Is there a fix for CVE-2026-123119?

Yes: fixed in 5.4.56, 6.4.50, 7.4.23, 8.1.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-123119 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-123119?

Check whether you run Symfony HttpClient at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123119: Symfony HttpClient NoPrivateNetworkHttpClient DNS rebinding in cached hosts

CVE-2026-123119 · Severity: info · Published 2026-11-05

Symfony's HttpClient component includes a security filter called NoPrivateNetworkHttpClient that blocks requests to private IP addresses. However, it fails to pin the checked IP address in its cache, allowing an attacker who controls a domain's DNS to use DNS rebinding to bypass this protection. On the first request, the attacker returns a public IP that passes the check; on subsequent requests within the same client session, they return a private IP, allowing reconnaissance of internal networks and ports.

Technologies: Symfony HttpClient. Vendors: Symfony.

Quick answers

Is CVE-2026-123119 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123119 being exploited in the wild.
How severe is CVE-2026-123119?: Informational severity, published 5 November 2026.
Which products and versions are affected?: Symfony HttpClient prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, 8.x prior to 8.1.11.
Is there a fix for CVE-2026-123119?: Yes: fixed in 5.4.56, 6.4.50, 7.4.23, 8.1.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123119 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-123119?: Check whether you run Symfony HttpClient at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.4.56, 6.4.50, 7.4.23, 8.1.11

Technical details

NoPrivateNetworkHttpClient resolves hostnames, validates the IP against private IP ranges, and passes the checked IP to the underlying HTTP client via the resolve option. The vulnerability lies in caching the DNS result per hostname but only passing the resolve option on first lookup; subsequent requests cause the underlying client to re-resolve the hostname independently, enabling DNS rebinding attacks. An attacker can determine whether internal ports are open based on connection error timing differences, even though the primary_ip check aborts the request before data is sent.

Affected products

Symfony HttpClient prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, 8.x prior to 8.1.11

Timeline

2026-11-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.