CVE-2026-48736: Symfony SSRF bypass in NoPrivateNetworkHttpClient and IpUtils

CVE-2026-48736 · Severity: medium · CVSS 4 · Published 2026-07-14

Symfony is a popular PHP framework used to build web applications. A security flaw in its networking components could allow attackers to bypass security filters designed to prevent access to internal private networks. This could lead to unauthorized access to sensitive internal services or data that should not be reachable from the public internet.

Technologies: symfony/http-foundation (Packagist), symfony/symfony (Packagist), Symfony Http Foundation, Symfony HttpClient. Vendors: Packagist, Symfony.

Quick answers

Is CVE-2026-48736 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48736 being exploited in the wild.
How severe is CVE-2026-48736?
Medium severity, with a CVSS score of 4, published 14 July 2026.
Which products and versions are affected?
symfony/http-client (Packagist) ECOSYSTEM:introduced=5.4.0,fixed=5.4.53; symfony/http-foundation (Packagist) ECOSYSTEM:introduced=6.4.0,fixed=6.4.41; symfony/symfony (Packagist) ECOSYSTEM:introduced=5.4.0,fixed=5.4.53; Symfony HttpClient >= 5.4.0, < 5.4.53; and 2 more.
Is there a fix for CVE-2026-48736?
Yes. symfony/http-client (Packagist): upgrade to 5.4.53 or later; symfony/http-foundation (Packagist): upgrade to 6.4.41 or later; symfony/symfony (Packagist): upgrade to 5.4.53 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48736 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48736?
Check whether you run symfony/http-client (Packagist), symfony/http-foundation (Packagist), symfony/symfony (Packagist) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • symfony/http-client (Packagist): upgrade to 5.4.53 or later
    composer require symfony/http-client:^5.4.53
  • symfony/http-foundation (Packagist): upgrade to 6.4.41 or later
    composer require symfony/http-foundation:^6.4.41
  • symfony/symfony (Packagist): upgrade to 5.4.53 or later
    composer require symfony/symfony:^5.4.53

Technical details

A Server-Side Request Forgery (SSRF) bypass exists in Symfony's HttpClient and HttpFoundation components. The NoPrivateNetworkHttpClient and IpUtils::isPrivateIp() functions failed to include several IPv6 transition prefixes (such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6) in their private network blocklists. An attacker can provide a specially crafted IPv6 address that embeds a private IPv4 address, effectively bypassing the 'no private network' restriction to reach internal targets. The issue is resolved by extending the PRIVATE_SUBNETS list to include these transition forms in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.

Affected products

  • Symfony Symfony >= 5.4.0, < 5.4.53; >= 6.0.0-BETA1, < 6.4.41; >= 7.0.0-BETA1, < 7.4.13; >= 8.0.0-BETA1, < 8.0.13
  • Symfony http-client >= 5.4.0, < 5.4.53
  • Symfony http-foundation >= 6.0.0-BETA1, < 6.4.41; >= 7.0.0-BETA1, < 7.4.13; >= 8.0.0-BETA1, < 8.0.13

Identifiers

  • CVE-2026-48736
  • GHSA-38cx-cq6f-5755

Timeline

  • 2026-07-14: advisory
  • 2026-05-27: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.