# CVE-2026-123125: Symfony Validator IpValidator SSRF in internal address filtering

Source: https://junglewise.ai/threats/cve-2026-123125-the-symfony-validator-component-ipvalidator-incompletely  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-123125 · Severity: info · Published 2026-11-05

Symfony's Validator component has a flaw in the IP address validation constraint that allows certain internal IP addresses to be incorrectly classified as public. Attackers can exploit this by using specially crafted IPv6 addresses (like ::ffff:127.0.0.1) that embed internal IPv4 addresses, potentially bypassing security checks that prevent Server-Side Request Forgery (SSRF) attacks against internal services.

Vendors: [Symfony](https://junglewise.ai/threats/vendors/symfony).

## Quick answers

**Is CVE-2026-123125 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123125 being exploited in the wild.

**How severe is CVE-2026-123125?** Informational severity, published 5 November 2026.

**Which products and versions are affected?** Symfony Validator 5.4.0 to 5.4.55, 6.x to 6.4.49, 7.x to 7.4.22, 8.x to 8.1.10.

**Is there a fix for CVE-2026-123125?** Yes: fixed in 5.4.56, 6.4.50, 7.4.23, 8.1.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123125 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-123125?** Check whether you run Symfony Validator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.4.56, 6.4.50, 7.4.23, 8.1.11

## Technical details

The IpValidator component relies on PHP's FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE flags to classify IP addresses as public or internal in filtered validation modes. However, these flags do not cover shared address space (100.64.0.0/10) or IPv4-mapped, IPv4-compatible, and 6to4 IPv6 address formats that can embed internal IPv4 addresses. An attacker can supply IPv6 addresses such as ::ffff:127.0.0.1 that pass validation despite pointing to localhost, allowing SSRF attacks against internal systems.

## Affected products

- Symfony Validator 5.4.0 to 5.4.55, 6.x to 6.4.49, 7.x to 7.4.22, 8.x to 8.1.10

## Timeline

- 2026-11-05: disclosed

## References

- [https://packagist.org/packages/symfony/validator](https://packagist.org/packages/symfony/validator)
- [https://github.com/symfony/symfony/commit/3bf8ea37fcb402c5ecc502a3f63012df85a7572e](https://github.com/symfony/symfony/commit/3bf8ea37fcb402c5ecc502a3f63012df85a7572e)