Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a Server-Side Request Forgery (SSRF) bypass in Symfony's NoPrivateNetworkHttpClient. The root cause is an incomplete denylist of private IP address ranges. Specifically, the PRIVATE_SUBNETS constant, used by the IP validation logic, was missing several IPv6 transition prefixes (6to4, Teredo, NAT64, and IPv4-compatible). An attacker could exploit this by crafting a URL with an IPv6 address that embeds a private IPv4 address (e.g., http://[2002:7f00:1::]/ which translates to 127.0.0.1). The function Symfony\Component\HttpFoundation\IpUtils::isPrivateIp, and its internal helper checkIp6, would fail to recognize this as a private address because the 2002::/16 prefix was not in its list of private subnets. As a result, isPrivateIp would return false. The Symfony\Component\HttpClient\NoPrivateNetworkHttpClient::request method, which relies on this check, would then incorrectly permit the request, forwarding it to the embedded private IP address on the internal network. The patches fix this vulnerability by adding the missing IPv6 prefixes to the PRIVATE_SUBNETS constant, ensuring that such addresses are correctly identified as private and blocked.
Symfony\Component\HttpClient\NoPrivateNetworkHttpClient::requestsrc/Symfony/Component/HttpClient/NoPrivateNetworkHttpClient.php
Symfony\Component\HttpFoundation\IpUtils::isPrivateIpsrc/Symfony/Component/HttpFoundation/IpUtils.php
Symfony\Component\HttpFoundation\IpUtils::checkIp6src/Symfony/Component/HttpFoundation/IpUtils.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| symfony/http-client | composer | >= 5.4.0, < 5.4.53 | 5.4.53 |
| symfony/http-foundation | composer | >= 6.4.0, < 6.4.41 | 6.4.41 |
| symfony/http-foundation | composer | >= 7.0.0, < 7.4.13 | 7.4.13 |
| symfony/http-foundation | composer | >= 8.0.0, < 8.0.13 | 8.0.13 |
| symfony/symfony | composer | >= 5.4.0, < 5.4.53 | 5.4.53 |
| symfony/symfony | composer | >= 6.4.0, < 6.4.41 | 6.4.41 |
| symfony/symfony | composer | >= 7.0.0, < 7.4.13 | 7.4.13 |
| symfony/symfony | composer | >= 8.0.0, < 8.0.13 | 8.0.13 |