CVE-2026-123119 in Symfony
Summary
by MITRE • 11/05/2026
The Symfony HttpClient component NoPrivateNetworkHttpClient does not pin the checked IP address of cached hosts, allowing for DNS rebinding to bypass private network restrictions, resulting in enumeration of internal hosts and ports in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.
NoPrivateNetworkHttpClient resolves the host of each request and checks the IP before connecting. It caches the result per host, and passes the IP to the decorated client through the resolve option so that the client connects to the exact IP that was checked. The issue is that resolve was only passed on the first lookup of a host: on subsequent requests, the decorated client resolved the host again on its own.
An attacker who controls a host's DNS can exploit this with DNS rebinding by answering the first lookup with a public IP, and subsequent lookups with a private IP, so when an application sends several requests to that host through the same client, the later requests connect to the private IP. This happens, for example, when an application fetches several URLs of a repository provided by a user. The check of the primary_ip in the on_progress callback still aborts the request before anything is sent, but the connection is made, and the error differs depending on whether the port is open or closed. This allows enumerating internal hosts and ports, as in CVE-2024-50342.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The Symfony HttpClient component contains a critical security vulnerability related to its NoPrivateNetworkHttpClient implementation, which fails to properly enforce private network access restrictions due to an inconsistency in how DNS resolution results are cached and applied across multiple requests. This flaw exists in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. The NoPrivateNetworkHttpClient is designed to prevent SSRF attacks by resolving the target host's IP address before initiating a connection and verifying that this IP does not belong to a private or local network range. To optimize performance, the component caches these resolved IPs per host and passes them via the resolve option to ensure subsequent connections use the exact checked IP rather than performing redundant lookups. However, the implementation contains a logical error where the cached IP is only passed on the very first lookup of a given host; for all subsequent requests using the same client instance, the underlying decorated client performs its own independent DNS resolution instead of adhering to the initially validated address.
This architectural inconsistency creates an opportunity for DNS rebinding attacks when an attacker controls or influences the DNS records for a target hostname. By manipulating the Domain Name System responses, an adversary can serve a public IP address during the initial request, which passes the private network check and gets cached by NoPrivateNetworkHttpClient. When subsequent requests are made to the same host through that client instance, such as when fetching multiple URLs from a user-provided repository or iterating over a list of resources, the decorated client ignores the cached public IP and performs fresh DNS lookups. If these secondary lookups return private network addresses, the connections will be established directly to internal infrastructure despite the initial security check having passed. This bypasses the intended isolation mechanisms designed to protect backend services from external access.
The operational impact of this vulnerability is significant, particularly for applications that process untrusted input involving multiple requests to a single domain or host. While the on_progress callback includes a secondary check using primary_ip that aborts data transmission before any payload is sent if a private IP is detected during later stages, the mere establishment of the TCP connection reveals information about the target environment. Specifically, the nature of the error returned by the network stack differs depending on whether the targeted internal port is open or closed. An attacker can leverage this distinction to perform port scanning and host enumeration within the internal network topology. This capability allows for detailed mapping of internal services, potentially leading to further exploitation of vulnerable backend applications that are not exposed to the public internet but remain accessible via these rebinding techniques.
This vulnerability aligns with CWE-20 Improper Input Validation as it involves a failure to correctly validate and maintain constraints on network addresses across multiple interactions. It also maps to MITRE ATT&CK technique T1557, specifically Adversary-in-the-Middle or Lateral Tool Transfer contexts where DNS rebinding is used to bypass security controls like firewalls or access control lists that rely on IP-based filtering. The scenario described mirrors the conditions of CVE-2024-50342, highlighting a recurring pattern in HTTP client implementations where caching mechanisms inadvertently undermine security checks. To mitigate this risk, organizations must upgrade Symfony HttpClient to version 5.4.56 or later for LTS branches, 6.4.50 or later for the 6.x line, 7.4.23 or later for the 7.x branch, and 8.1.11 or later for the latest development release. Until upgrading is possible, developers should avoid using NoPrivateNetworkHttpClient with clients that maintain persistent state across multiple requests to untrusted hosts, or implement additional validation layers at the application level to ensure IP consistency throughout the request lifecycle.