DEBIAN-CVE-2026-123125: SSRF
The Symfony Validator component IpValidator incompletely classifies internal addresses in the filtered modes of the Ip constraint, so some internal addresses are accepted as public, which can lead to Server-Side Request Forgery (SSRF) in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. In these modes, IpValidator relies on the PHP flags FILTERFLAGNOPRIVRANGE and FILTERFLAGNORESRANGE to classify addresses as public, private, or reserved. These flags do not cover shared address space (100.64.0.0/10) or IPv4-mapped, IPv4-compatible, and 6to4 IPv6 addresses, which can embed internal IPv4 addresses. A value such as ::ffff:127.0.0.1 can therefore pass validation even though it points to an internal host. Applications that rely on the Ip constraint to reject internal addresses, for example before making a server-side request to a user-supplied address, can be exposed to SSRF.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
symfony/validatorto a version that resolves this vulnerability.Fixed in 5.4.56 - Upgrade
Upgrade
symfony/validatorto a version that resolves this vulnerability.Fixed in 6.4.50 - Upgrade
Upgrade
symfony/validatorto a version that resolves this vulnerability.Fixed in 7.4.23 - Upgrade
Upgrade
symfony/validatorto a version that resolves this vulnerability.Fixed in 8.1.11
Event History
Frequently Asked Questions
Which applications are exposed to exploitation?
Applications are exposed when they use Symfony's Ip constraint in filtered modes to reject internal addresses and then make a server-side request to a user-supplied address. The issue can allow addresses such as ::ffff:127.0.0.1 to be accepted as public even though they resolve to an internal target.
What address forms can bypass the intended internal-address filtering?
The affected PHP filter flags do not cover shared address space 100.64.0.0/10, IPv4-mapped IPv6 addresses, IPv4-compatible IPv6 addresses, or 6to4 IPv6 addresses that embed internal IPv4 addresses.
Are all Symfony versions affected?
Affected versions are Symfony releases before 5.4.56, 6.x before 6.4.50, 7.x before 7.4.23, and 8.x before 8.1.11. The provided data does not identify whether a particular application uses the vulnerable filtered Ip constraint modes.