AIKIDO-2026-10964
symfony/http-client is vulnerable to Server-Side Request Forgery (SSRF)
65
Medium Risk
This Affects:
symfony/http-clientTL;DR
The 5.4 line of symfony/http-client uses a private subnet list inside NoPrivateNetworkHttpClient to block requests to private networks. Before the fix, that list omitted IPv6 transition forms that can embed private IPv4 addresses, including 6to4, Teredo, NAT64, and IPv4-compatible literals. An attacker who can supply a URL may encode loopback or RFC1918 addresses in those forms so the decorator treats the destination as public and dispatches the request. The fix adds those transition prefixes to the blocked subnet list.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
symfony/http-client is vulnerable to Server-Side Request Forgery (SSRF) in versions 5.4.0 - 5.4.52.
How to fix this
Upgrade the symfony/http-client and/or the symfony/symfony library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant