CVE-2026-48736

HighCVSS 8.6/10Last modified Jul 16, 2026

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6, allowing attacker-supplied URLs to represent private IPv4 targets in forms that IpUtils::isPrivateIp() did not block. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-184 CWE-918

Affected software

Vendor	Product	Versions
symfony	symfony	>= 5.4.0, < 5.4.53; >= 6.0.0-BETA1, < 6.4.41; >= 7.0.0-BETA1, < 7.4.13; >= 8.0.0-BETA1, < 8.0.13
symfony	http-client	>= 5.4.0, < 5.4.53
symfony	http-foundation	>= 6.0.0-BETA1, < 6.4.41; >= 7.0.0-BETA1, < 7.4.13; >= 8.0.0-BETA1, < 8.0.13

References

https://github.com/symfony/symfony/commit/82765368cf74177c36613575182f168a2eb765b2Patch
https://github.com/symfony/symfony/commit/85b831555be8ea1f43bf01078afe87bc4c92f65ePatch
https://github.com/symfony/symfony/releases/tag/v5.4.53Release Notes
https://github.com/symfony/symfony/releases/tag/v6.4.41Release Notes
https://github.com/symfony/symfony/releases/tag/v7.4.13Release Notes
https://github.com/symfony/symfony/security/advisories/GHSA-38cx-cq6f-5755Patch, Vendor Advisory

Timeline

Published: Jul 14, 2026
Last modified: Jul 16, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-487374.9pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, is_global_address in src/pyload/core/utils/web CVE-2026-48743.1A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_h CVE-2026-487417.5libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. P CVE-2026-487437.5Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, Envoy c CVE-2026-487446.5Saleor is an e-commerce platform. From 3.14.67 until 3.21.67, 3.22.63, and 3.23.22, a broken authorization check in saleor/permission/utils.CVE-2026-487459.3Traccar Client is a GPS tracking mobile app for sending location updates to private servers using the open-source Traccar platform. In versi CVE-2026-487469.1vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and s CVE-2026-487475.3Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.13 and 8.0.13, MailomatReques CVE-2026-487487.5Netty is a network application framework for development of protocol servers and clients. Starting in version 4.2.0.Final and prior to versi CVE-2026-487499.9Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/wri CVE-2026-48754.7A vulnerability was determined in itsourcecode Free Hotel Reservation System 1.0. The affected element is an unknown function of the file /a CVE-2026-487509.9Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output` parameter of the `/instances/$name/exec