Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-123119— Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)

Quick assessment

Affected
sensiolabs symfony
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Symfony 的 HttpClient 组件中的 未对缓存的主机所检查的 IP 地址进行绑定（pinning），导致攻击者可通过 DNS 重绑定（DNS rebinding）绕过私有网络限制，从而在以下版本中枚举内部主机和端口：Symfony 5.x 早于 5.4.56、6.x 早于 6.4.50、7.x 早于 7.4.23，以及 8.x 早于 8.1.11。 会在建立连接前解析每个请求的主机名并检查其 IP 地址。该组件按主机缓存解析结果，并通过 选项将 IP 地址传递给被装饰（decorated）的客户端，以

CVSS 2.3 · Low

Affected Version Matrix 4

VendorProduct Version RangeStatus
sensiolabs symfony < 5.4.56 affected
6.0.0< 6.4.50 affected
7.0.0< 7.4.23 affected
8.0.0< 8.1.11 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-123119

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)
Source: CVE Program / CVE List V5
Vulnerability Description
The Symfony HttpClient component NoPrivateNetworkHttpClient does not pin the checked IP address of cached hosts, allowing for DNS rebinding to bypass private network restrictions, resulting in enumeration of internal hosts and ports in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. NoPrivateNetworkHttpClient resolves the host of each request and checks the IP before connecting. It caches the result per host, and passes the IP to the decorated client through the resolve option so that the client connects to the exact IP that was checked. The issue is that resolve was only passed on the first lookup of a host: on subsequent requests, the decorated client resolved the host again on its own. An attacker who controls a host's DNS can exploit this with DNS rebinding by answering the first lookup with a public IP, and subsequent lookups with a private IP, so when an application sends several requests to that host through the same client, the later requests connect to the private IP. This happens, for example, when an application fetches several URLs of a repository provided by a user. The check of the primary_ip in the on_progress callback still aborts the request before anything is sent, but the connection is made, and the error differs depending on whether the port is open or closed. This allows enumerating internal hosts and ports, as in CVE-2024-50342.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
检查时间与使用时间(TOCTOU)的竞争条件
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
sensiolabs symfony 0 ~ 5.4.56 -

II. Public POCs for CVE-2026-123119

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-123119

请登录查看更多情报信息。

Other References for CVE-2026-123119 (2)

Same Patch Batch · sensiolabs · 2026-11-05 · 4 CVEs total

CVE-2026-123125 6.3 MEDIUM Symfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Ad
CVE-2026-118517 2.3 LOW Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well
CVE-2026-121949 2.3 LOW Symfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host

IV. Related Vulnerabilities

Same product: symfony
Same vendor: sensiolabs
Same weakness: CWE-367