CVE-2026-123125 in Symfony
Summary
by MITRE • 11/05/2026
The Symfony Validator component IpValidator incompletely classifies internal addresses in the filtered modes of the Ip constraint, so some internal addresses are accepted as public, which can lead to Server-Side Request Forgery (SSRF) in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.
In these modes, IpValidator relies on the PHP flags FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE to classify addresses as public, private, or reserved. These flags do not cover shared address space (100.64.0.0/10) or IPv4-mapped, IPv4-compatible, and 6to4 IPv6 addresses, which can embed internal IPv4 addresses. A value such as ::ffff:127.0.0.1 can therefore pass validation even though it points to an internal host. Applications that rely on the Ip constraint to reject internal addresses, for example before making a server-side request to a user-supplied address, can be exposed to SSRF.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The Symfony Validator component contains a critical logic flaw within its IpValidator class that allows internal network addresses to bypass validation filters designed to restrict input to public IP ranges. This vulnerability stems from an incomplete classification of Internet Protocol (IP) addresses when the validator operates in filtered modes, specifically those utilizing PHP’s FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE flags. These standard PHP flags are intended to exclude private address spaces such as RFC 1918 ranges and reserved blocks like loopback or link-local addresses from being considered public. However, they fail to account for several other categories of non-public IP space that can be used to reach internal services, creating a significant security gap in applications relying on this validation logic to enforce network boundaries.
The technical root cause lies in the specific handling of shared address space and various IPv6 encapsulation formats. The validator does not properly identify addresses within the 100.64.0.0/10 prefix range, which is designated for carrier-grade NAT operations by IANA but remains inaccessible to external public internet traffic. Furthermore, the validation logic fails to detect internal IPv4 addresses embedded within special IPv6 formats, including IPv4-mapped addresses (::ffff:), IPv4-compatible addresses (::), and 6to4 transition addresses (2002::/16). For instance, an attacker can supply a value such as ::ffff:127.0.0.1 or ::ffff:192.168.1.1. While these strings represent internal loopback or private network destinations in IPv4 terms, the IpValidator incorrectly interprets them as valid public addresses because they do not fall within the specific bit patterns checked by the standard PHP flags for private and reserved ranges.
This misclassification has severe operational implications, primarily facilitating Server-Side Request Forgery attacks. In many Symfony-based applications, the Ip constraint is employed to sanitize user-supplied input before it is used in server-side HTTP requests or other network operations. When an application trusts this validation output, it assumes that any accepted IP address belongs to a public entity outside its local infrastructure. An attacker exploiting this flaw can provide an internal IP address disguised as a valid IPv6 mapped address or within the shared NAT range. The application then proceeds to make a request to this internal destination, effectively bypassing network-level security controls and allowing access to backend services, databases, or administrative interfaces that are not exposed to the public internet. This behavior aligns with CWE-918 Server-Side Request Forgery (SSRF), where insufficient validation of user-supplied URLs leads to unauthorized server-side interactions.
The vulnerability affects multiple major branches of the Symfony framework, including versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. Organizations running these versions are at risk if they utilize the Ip validator for security-critical decisions involving network access control or SSRF prevention. The ATT&CK framework categorizes this type of vulnerability under T1560.002, specifically Data Encrypted via Network Protocol, as attackers may leverage internal routing to exfiltrate data or pivot through compromised systems using protocols that the validator incorrectly deems safe for external communication.
Mitigation requires immediate upgrading to a patched version of Symfony within each supported branch mentioned above. For environments where an upgrade is not immediately feasible, developers should implement additional validation layers outside of the standard Ip constraint. This includes manually checking input against known internal CIDR blocks such as 100.64.0.0/10 and explicitly rejecting IPv6 addresses that map to IPv4 private or loopback ranges using regular expressions or custom PHP logic before passing data to the validator. Additionally, implementing strict allow-lists for outbound network connections at the application server level can provide a defense-in-depth strategy, ensuring that even if validation is bypassed, the underlying infrastructure prevents access to sensitive internal resources.