CVE-2026-48736

Analyzed Analyzed - Analysis Complete

IPv6 Transition Bypass in Symfony Framework

Publication date: 2026-07-14

Last updated on: 2026-07-16

Assigner: GitHub, Inc.

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6, allowing attacker-supplied URLs to represent private IPv4 targets in forms that IpUtils::isPrivateIp() did not block. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-16

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-48736

Affected Vendors & Products

Vendor	Product	Version / Range
sensiolabs	symfony	From 7.0.0 (inc) to 7.4.13 (exc)
sensiolabs	symfony	From 8.0.0 (inc) to 8.0.13 (exc)
sensiolabs	symfony	From 5.4.0 (inc) to 5.4.43 (exc)
sensiolabs	symfony	From 6.4.0 (inc) to 6.4.41 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-184	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

Executive Summary

This vulnerability affects Symfony, a PHP framework, where NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS failed to block IPv6 transition prefixes like 6to4, NAT64, Teredo, and IPv4-compatible IPv6. This allowed attacker-supplied URLs to bypass private IP checks and represent private IPv4 targets in ways that IpUtils::isPrivateIp() did not detect.

Detection Guidance

This vulnerability involves IPv6 transition prefixes (6to4, NAT64, Teredo, IPv4-compatible IPv6) being omitted from private network checks in Symfony's NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS. To detect it, inspect Symfony applications using versions 5.4.0 to 5.4.53, 6.4.41, 7.4.13, or 8.0.13 for exposed HTTP clients or IP validation logic. Check logs for SSRF attempts targeting private IPv4 addresses via IPv6 formats.

Impact Analysis

An attacker could exploit this to bypass network restrictions and access internal systems or services, potentially leading to unauthorized data access, service disruption, or further attacks within a private network.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using vulnerable Symfony versions may face compliance breaches and regulatory penalties.

Mitigation Strategies

Update Symfony to versions 5.4.53, 6.4.41, 7.4.13, or 8.0.13 or later to address the IPv6 transition prefix bypass in NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS.

Hi! I’m here to help you understand CVE-2026-48736. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70