Is CVE-2026-123125 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123125 being exploited in the wild.

How severe is CVE-2026-123125?

Informational severity, published 5 November 2026.

Which products and versions are affected?

Symfony Validator 5.4.0 to 5.4.55, 6.x to 6.4.49, 7.x to 7.4.22, 8.x to 8.1.10.

Is there a fix for CVE-2026-123125?

Yes: fixed in 5.4.56, 6.4.50, 7.4.23, 8.1.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-123125 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-123125?

Check whether you run Symfony Validator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123125: Symfony Validator IpValidator SSRF in internal address filtering

CVE-2026-123125 · Severity: info · Published 2026-11-05

Symfony's Validator component has a flaw in the IP address validation constraint that allows certain internal IP addresses to be incorrectly classified as public. Attackers can exploit this by using specially crafted IPv6 addresses (like ::ffff:127.0.0.1) that embed internal IPv4 addresses, potentially bypassing security checks that prevent Server-Side Request Forgery (SSRF) attacks against internal services.

Vendors: Symfony.

Quick answers

Is CVE-2026-123125 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123125 being exploited in the wild.
How severe is CVE-2026-123125?: Informational severity, published 5 November 2026.
Which products and versions are affected?: Symfony Validator 5.4.0 to 5.4.55, 6.x to 6.4.49, 7.x to 7.4.22, 8.x to 8.1.10.
Is there a fix for CVE-2026-123125?: Yes: fixed in 5.4.56, 6.4.50, 7.4.23, 8.1.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123125 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-123125?: Check whether you run Symfony Validator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.4.56, 6.4.50, 7.4.23, 8.1.11

Technical details

The IpValidator component relies on PHP's FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE flags to classify IP addresses as public or internal in filtered validation modes. However, these flags do not cover shared address space (100.64.0.0/10) or IPv4-mapped, IPv4-compatible, and 6to4 IPv6 address formats that can embed internal IPv4 addresses. An attacker can supply IPv6 addresses such as ::ffff:127.0.0.1 that pass validation despite pointing to localhost, allowing SSRF attacks against internal systems.

Affected products

Symfony Validator 5.4.0 to 5.4.55, 6.x to 6.4.49, 7.x to 7.4.22, 8.x to 8.1.10

Timeline

2026-11-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.