CVE-2026-123125

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-123125

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-123125.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-123125

Aliases

GHSA-4qpf-57w4-m3wc

Published

2026-11-05T15:55:11Z

Modified

2026-11-05T21:32:29Z

Severity

6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

Symfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter Bypass

Details

The Symfony Validator component IpValidator incompletely classifies internal addresses in the filtered modes of the Ip constraint, so some internal addresses are accepted as public, which can lead to Server-Side Request Forgery (SSRF) in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.

In these modes, IpValidator relies on the PHP flags FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE to classify addresses as public, private, or reserved. These flags do not cover shared address space (100.64.0.0/10) or IPv4-mapped, IPv4-compatible, and 6to4 IPv6 addresses, which can embed internal IPv4 addresses. A value such as ::ffff:127.0.0.1 can therefore pass validation even though it points to an internal host. Applications that rely on the Ip constraint to reject internal addresses, for example before making a server-side request to a user-supplied address, can be exposed to SSRF.

Database specific

{
    "cna_assigner": "Checkmarx",
    "cwe_ids": [
        "CWE-184",
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123125.json"
}

References

Affected packages

Git / github.com/symfony/validator

Affected ranges

Type

GIT

Repo

https://github.com/symfony/validator

Events

Introduced

Fixed

ae093b1e86191b10f1d968c80d2bd9b87bfd2e9b

Introduced

ba04b96b381270b972c5be1f7ae2113b280f64c0

Fixed

7512ee102ab329715b267fa72710113de6ca1d08

Introduced

616b39ffb22c1519f7fd2582b8052cde4c2d0b9f

Fixed

0208748881024578b32edb7fad3d2cb01a88c364

Introduced

e764d277effd5b6186daf0f542d8b67f3f15bc2d

Fixed

9aa1e091b49b802e584cc4e583e7a8a182c04591

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "5.4.56"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.4.50"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "7.0.0"
                },
                {
                    "fixed": "7.4.23"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "8.0.0"
                },
                {
                    "fixed": "8.1.11"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Affected versions

v2.*

v2.0.0

v2.0.1

v2.1.0

v2.4.0-BETA1

v2.4.0-BETA2

v2.4.0-RC1

v2.5.0-BETA1

v2.5.0-BETA2

v2.5.0-RC1

v2.6.0-BETA1

v3.*

v3.0.0

v3.0.0-BETA1

v3.1.0-BETA1

v3.2.0-BETA1

v3.2.0-RC1

v3.3.0-BETA1

v3.3.0-RC1

v4.*

v4.0.0

v4.0.0-BETA1

v4.0.0-BETA2

v4.0.0-BETA3

v4.0.0-BETA4

v4.0.0-RC1

v4.0.0-RC2

v4.1.0-BETA1

v4.2.0-BETA1

v4.2.0-BETA2

v4.2.0-RC1

v4.3.0-BETA1

v5.*

v5.0.0-BETA1

v5.0.0-BETA2

v5.0.0-RC1

v5.1.0-BETA1

v5.1.0-RC1

v5.2.0

v5.2.0-BETA1

v5.2.0-BETA2

v5.2.0-BETA3

v5.2.0-RC1

v5.2.0-RC2

v5.2.1

v5.3.0-BETA1

v5.3.0-RC1

v5.4.0

v5.4.0-BETA1

v5.4.0-BETA2

v5.4.0-BETA3

v5.4.0-RC1

v5.4.1

v5.4.10

v5.4.11

v5.4.12

v5.4.13

v5.4.14

v5.4.15

v5.4.17

v5.4.19

v5.4.2

v5.4.21

v5.4.22

v5.4.23

v5.4.24

v5.4.25

v5.4.26

v5.4.28

v5.4.29

v5.4.3

v5.4.30

v5.4.31

v5.4.32

v5.4.34

v5.4.35

v5.4.36

v5.4.38

v5.4.39

v5.4.40

v5.4.41

v5.4.42

v5.4.43

v5.4.44

v5.4.45

v5.4.46

v5.4.47

v5.4.48

v5.4.5

v5.4.6

v5.4.7

v5.4.8

v6.*

v6.0.0

v6.1.0

v6.1.0-BETA1

v6.1.0-RC1

v6.2.0

v6.2.0-BETA1

v6.2.0-BETA2

v6.2.0-BETA3

v6.2.0-RC1

v6.3.0-BETA1

v6.3.0-RC1

v6.4.0

v6.4.0-BETA1

v6.4.0-BETA2

v6.4.0-BETA3

v6.4.0-RC1

v6.4.0-RC2

v6.4.10

v6.4.11

v6.4.12

v6.4.13

v6.4.14

v6.4.15

v6.4.16

v6.4.17

v6.4.18

v6.4.19

v6.4.2

v6.4.20

v6.4.21

v6.4.22

v6.4.23

v6.4.24

v6.4.25

v6.4.26

v6.4.27

v6.4.29

v6.4.3

v6.4.30

v6.4.31

v6.4.33

v6.4.34

v6.4.35

v6.4.36

v6.4.37

v6.4.4

v6.4.42

v6.4.43

v6.4.44

v6.4.45

v6.4.46

v6.4.47

v6.4.48

v6.4.49

v6.4.6

v6.4.7

v6.4.8

v6.4.9

v7.*

v7.0.0

v7.1.0

v7.1.0-BETA1

v7.1.0-RC1

v7.2.0

v7.2.0-BETA1

v7.2.0-BETA2

v7.2.0-RC1

v7.3.0

v7.3.0-BETA1

v7.3.0-RC1

v7.4.0

v7.4.0-BETA1

v7.4.0-BETA2

v7.4.0-RC1

v7.4.0-RC3

v7.4.1

v7.4.10

v7.4.14

v7.4.15

v7.4.16

v7.4.17

v7.4.18

v7.4.19

v7.4.2

v7.4.20

v7.4.21

v7.4.22

v7.4.3

v7.4.4

v7.4.5

v7.4.6

v7.4.7

v7.4.8

v7.4.9

v8.*

v8.0.0

v8.0.0-RC3

v8.0.1

v8.0.2

v8.1.0

v8.1.0-BETA1

v8.1.0-BETA2

v8.1.0-BETA3

v8.1.0-RC1

v8.1.1

v8.1.10

v8.1.2

v8.1.4

v8.1.5

v8.1.6

v8.1.7

v8.1.8

v8.1.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-123125.json"