CVE-2026-48736 Overview
CVE-2026-48736 is a Server-Side Request Forgery (SSRF) protection bypass in the Symfony PHP framework. The flaw affects NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS in Symfony versions 5.4.0 through 5.4.52, 6.4.x through 6.4.40, 7.4.x through 7.4.12, and 8.0.x through 8.0.12. These components omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6 addresses. Attacker-supplied URLs can represent private IPv4 targets in encoded IPv6 forms that IpUtils::isPrivateIp() fails to block. The issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.
Critical Impact
Attackers can bypass private-network filtering to reach internal services, cloud metadata endpoints, and other resources that should be inaccessible from public HTTP client requests.
Affected Products
- Symfony 5.4.0 through 5.4.52
- Symfony 6.4.0 through 6.4.40
- Symfony 7.4.0 through 7.4.12 and 8.0.0 through 8.0.12
Discovery Timeline
- 2026-07-14 - CVE-2026-48736 published to NVD
- 2026-07-16 - Last updated in NVD database
Technical Details for CVE-2026-48736
Vulnerability Analysis
The vulnerability sits in Symfony's private-network guardrails used to prevent SSRF. Both IpUtils::PRIVATE_SUBNETS in HttpFoundation and the private-subnet list inside NoPrivateNetworkHttpClient enumerated only a subset of IPv6 ranges that map to private IPv4 space. Missing entries included ::/96 (IPv4-compatible IPv6), 2002::/16 (6to4), 2001::/32 (Teredo), and the NAT64 well-known and local-use prefixes 64:ff9b::/96 and 64:ff9b:1::/48. Because IpUtils::isPrivateIp() returned false for these prefixes, requests targeting an IPv6 address such as [::ffff:127.0.0.1] variants or a 6to4-wrapped private IPv4 could reach internal hosts. This weakness maps to [CWE-184: Incomplete List of Disallowed Inputs].
Root Cause
The private-subnet allowlist was incomplete. It enumerated common IPv6 ranges such as fc00::/7, fe80::/10, and ::ffff:0:0/96 but ignored transition mechanisms defined in RFC 3056, RFC 4380, RFC 6052, and RFC 8215. Any IPv6 representation of an RFC1918 IPv4 host outside the allowlist was treated as public.
Attack Vector
An attacker submits a URL to a Symfony application that fetches remote resources through NoPrivateNetworkHttpClient or validates hosts with IpUtils::isPrivateIp(). By encoding an internal IPv4 destination inside a 6to4 (2002::/16), Teredo (2001::/32), NAT64 (64:ff9b::/96), or IPv4-compatible IPv6 (::/96) address, the request bypasses filtering and hits internal endpoints such as 169.254.169.254 cloud metadata services or internal management APIs.
// Patch: src/Symfony/Component/HttpFoundation/IpUtils.php
'::1/128', // Loopback
'fc00::/7', // Unique Local Address
'fe80::/10', // Link Local Address
- '::ffff:0:0/96', // IPv4 translations
+ '::ffff:0:0/96', // IPv4-mapped IPv6 addresses (RFC 4291 section 2.5.5.2)
'::/128', // Unspecified address
+ '::/96', // IPv4-compatible IPv6 addresses (RFC 4291 section 2.5.5.1)
+ '2002::/16', // 6to4 (RFC 3056)
+ '2001::/32', // Teredo tunneling (RFC 4380)
+ '64:ff9b::/96', // NAT64 well-known prefix (RFC 6052)
+ '64:ff9b:1::/48', // NAT64 local-use prefix (RFC 8215)
];
Source: Symfony HttpFoundation patch commit 85b8315. The corresponding NoPrivateNetworkHttpClient fix is in commit 8276536.
Detection Methods for CVE-2026-48736
Indicators of Compromise
- Outbound HTTP requests originating from PHP-FPM or Symfony worker processes toward addresses in the 2002::/16, 2001::/32, 64:ff9b::/96, or ::/96 ranges.
- Application logs showing user-supplied URLs containing bracketed IPv6 literals that decode to RFC1918 IPv4 space.
- Successful HTTP fetches to internal-only hostnames or cloud metadata IPs (169.254.169.254) initiated by web application processes.
Detection Strategies
- Inspect web request parameters for IPv6 literals matching known transition prefixes and correlate with subsequent outbound connections.
- Instrument NoPrivateNetworkHttpClient call sites to log resolved destination IPs and alert on any address that resolves to private IPv4 space post-lookup.
- Review Symfony version inventories in composer.lock files across CI/CD pipelines to flag vulnerable releases.
Monitoring Recommendations
- Enable egress network logging on application servers and alert on outbound connections to link-local, ULA, or metadata endpoints.
- Monitor DNS resolutions returning AAAA records for the affected transition prefixes when originating from application workloads.
- Track error rates and 4xx/5xx anomalies from Symfony HTTP client operations following deployment of the patched version.
How to Mitigate CVE-2026-48736
Immediate Actions Required
- Upgrade Symfony to 5.4.53, 6.4.41, 7.4.13, or 8.0.13 depending on the branch in use.
- Audit all application code that accepts URLs from untrusted input and passes them to HttpClient or validates hosts with IpUtils::isPrivateIp().
- Enforce egress network controls that block traffic from application tiers to internal management networks and cloud metadata endpoints.
Patch Information
The fixes are published in Symfony release v5.4.53, v6.4.41, and v7.4.13. Full advisory details are available in GHSA-38cx-cq6f-5755. The patch extends the private-subnet allowlist to include IPv6 transition prefixes covering 6to4, Teredo, NAT64, and IPv4-compatible IPv6 addresses.
Workarounds
- Add an application-level URL validator that rejects any IPv6 literal in the 2002::/16, 2001::/32, 64:ff9b::/96, 64:ff9b:1::/48, or ::/96 ranges before invoking the HTTP client.
- Deploy a forward proxy that enforces destination allowlists for outbound HTTP requests from Symfony applications.
- Configure host firewalls or cloud security groups to deny egress from application servers to RFC1918 ranges and IMDS endpoints where not explicitly required.
# Composer upgrade to a patched Symfony release
composer require symfony/http-client:^7.4.13 symfony/http-foundation:^7.4.13
composer update symfony/http-client symfony/http-foundation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
