Executive brief
Symfony is a popular PHP framework used to build web applications. A security flaw in its networking components could allow attackers to bypass security filters designed to prevent access to internal private networks. This could lead to unauthorized access to sensitive internal services or data that should not be reachable from the public internet.
Technical details
A Server-Side Request Forgery (SSRF) bypass exists in Symfony's HttpClient and HttpFoundation components. The NoPrivateNetworkHttpClient and IpUtils::isPrivateIp() functions failed to include several IPv6 transition prefixes (such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6) in their private network blocklists. An attacker can provide a specially crafted IPv6 address that embeds a private IPv4 address, effectively bypassing the 'no private network' restriction to reach internal targets. The issue is resolved by extending the PRIVATE_SUBNETS list to include these transition forms in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.
Affected products
- Symfony Symfony >= 5.4.0, < 5.4.53; >= 6.0.0-BETA1, < 6.4.41; >= 7.0.0-BETA1, < 7.4.13; >= 8.0.0-BETA1, < 8.0.13
- Symfony http-client >= 5.4.0, < 5.4.53
- Symfony http-foundation >= 6.0.0-BETA1, < 6.4.41; >= 7.0.0-BETA1, < 7.4.13; >= 8.0.0-BETA1, < 8.0.13
Timeline
- 2026-07-14: advisory
- 2026-05-27: patched
References
- https://github.com/symfony/symfony/commit/82765368cf74177c36613575182f168a2eb765b2
- https://github.com/symfony/symfony/commit/85b831555be8ea1f43bf01078afe87bc4c92f65e
- https://github.com/symfony/symfony/releases/tag/v5.4.53
- https://github.com/symfony/symfony/releases/tag/v6.4.41
- https://github.com/symfony/symfony/releases/tag/v7.4.13
- https://github.com/symfony/symfony/security/advisories/GHSA-38cx-cq6f-5755