AIKIDO-2026-10963
symfony/http-foundation is vulnerable to Server-Side Request Forgery (SSRF)
65
Medium Risk
This Affects:
symfony/http-foundationTL;DR
The IpUtils::PRIVATE_SUBNETS constant and IpUtils::isPrivateIp() helper enumerate private IPv4 and common IPv6 ranges but omit IPv6 transition forms that embed private IPv4 addresses. An attacker who can supply a URL may use 6to4, Teredo, NAT64, or IPv4-compatible IPv6 literals so NoPrivateNetworkHttpClient and other callers treat the target as public and dispatch the request. Pre-fix versions cross the decorator's private-network boundary even when the embedded address is loopback or RFC1918. The fix adds the missing transition prefixes to PRIVATE_SUBNETS and covers them in tests.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
symfony/http-foundation is vulnerable to Server-Side Request Forgery (SSRF) in versions 6.4.0 - 6.4.40, 7.0.0 - 7.4.12 and 8.0.0 - 8.0.12.
How to fix this
Upgrade the symfony/http-foundation and/or the symfony/symfony library to the patch version.
Links
GitHub Releases
github.com/symfony/http-foundation/releases/tag/v8.0.13github.com/symfony/symfony/releases/tag/v5.4.53github.com/symfony/symfony/releases/tag/v6.4.41github.com/symfony/symfony/releases/tag/v7.4.13Fix Commits
github.com/symfony/symfony/commit/82765368cf74177c36613575182f168a2eb765b2github.com/symfony/symfony/commit/85b831555be8ea1f43bf01078afe87bc4c92f65e
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.