CVE-2026-123119

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123119", "assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "state": "PUBLISHED", "assignerShortName": "Checkmarx", "dateReserved": "2026-11-05T12:32:19.431Z", "datePublished": "2026-11-05T12:57:35.267Z", "dateUpdated": "2026-11-05T19:03:19.483Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "shortName": "Checkmarx", "dateUpdated": "2026-11-05T12:57:35.267Z"}, "title": "Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-367", "description": "CWE-367 Time-of-check time-of-use (TOCTOU) race condition", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-918", "description": "CWE-918 Server-Side request forgery (SSRF)", "type": "CWE"}]}], "affected": [{"vendor": "sensiolabs", "product": "symfony", "collectionURL": "https://packagist.org/packages/symfony/http-client", "packageName": "symfony/http-client", "repo": "https://github.com/symfony/http-client", "modules": ["Symfony\\Component\\HttpClient\\NoPrivateNetworkHttpClient"], "versions": [{"status": "affected", "version": "0", "lessThan": "5.4.56", "versionType": "git"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.4.50", "versionType": "git"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.4.23", "versionType": "git"}, {"status": "affected", "version": "8.0.0", "lessThan": "8.1.11", "versionType": "git"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Symfony HttpClient component\u00a0NoPrivateNetworkHttpClient\u00a0does not pin the checked IP address of cached hosts, allowing for DNS rebinding to bypass private network restrictions, resulting in enumeration of internal hosts and ports in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\n\nNoPrivateNetworkHttpClient resolves the host of each request and checks the IP before connecting. It caches the result per host, and passes the IP to the decorated client through the\u00a0resolve option so that the client connects to the exact IP that was checked. The issue is that\u00a0resolve was only passed on the first lookup of a host: on subsequent requests, the decorated client resolved the host again on its own.\n\nAn attacker who controls a host's DNS can exploit this with DNS rebinding by answering the first lookup with a public IP, and subsequent lookups with a private IP, so when an application sends several requests to that host through the same client, the later requests connect to the private IP. This happens, for example, when an application fetches several URLs of a repository provided by a user. The check of the\u00a0primary_ip\u00a0in the\u00a0on_progress\u00a0callback still aborts the request before anything is sent, but the connection is made, and the error differs depending on whether the port is open or closed. This allows enumerating internal hosts and ports, as in CVE-2024-50342.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>The Symfony HttpClient component&nbsp;<code>NoPrivateNetworkHttpClient</code>&nbsp;does not pin the checked IP address of cached hosts, allowing for DNS rebinding to bypass private network restrictions, resulting in enumeration of internal hosts and ports in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.</div><div><code>NoPrivateNetworkHttpClient</code> resolves the host of each request and checks the IP before connecting. It caches the result per host, and passes the IP to the decorated client through the&nbsp;<code>resolve</code> option so that the client connects to the exact IP that was checked. The issue is that&nbsp;<code>resolve</code><span> was only passed on the first lookup of a host: on subsequent requests, the decorated client resolved the host again on its own.</span></div><div>An attacker who controls a host's DNS can exploit this with DNS rebinding by answering the first lookup with a public IP, and subsequent lookups with a private IP, so when an application sends several requests to that host through the same client, the later requests connect to the private IP. This happens, for example, when an application fetches several URLs of a repository provided by a user. The check of the&nbsp;<code>primary_ip</code>&nbsp;in the&nbsp;<code>on_progress</code>&nbsp;callback still aborts the request before anything is sent, but the connection is made, and the error differs depending on whether the port is open or closed. This allows enumerating internal hosts and ports, as in CVE-2024-50342.</div>"}]}], "references": [{"url": "https://github.com/symfony/symfony/security/advisories/GHSA-c7hm-wqwp-f9v8", "tags": ["third-party-advisory"]}, {"url": "https://github.com/symfony/symfony/commit/ab084826b2b5db8d0b91af635fe2b5e1c4f699f9", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "LOW", "baseScore": 2.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Eirik Stanghelle Morland from Packagist", "type": "reporter"}, {"lang": "en", "value": "Nicolas Grekas", "type": "remediation developer"}], "source": {"advisory": "GHSA-c7hm-wqwp-f9v8", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T14:13:38.399973Z", "id": "CVE-2026-123119", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:03:19.483Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-123119", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T14:13:38.399973Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:03:13.518Z"}}], "cna": {"title": "Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)", "source": {"advisory": "GHSA-c7hm-wqwp-f9v8", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Eirik Stanghelle Morland from Packagist"}, {"lang": "en", "type": "remediation developer", "value": "Nicolas Grekas"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/symfony/http-client", "vendor": "sensiolabs", "modules": ["Symfony\\Component\\HttpClient\\NoPrivateNetworkHttpClient"], "product": "symfony", "versions": [{"status": "affected", "version": "0", "lessThan": "5.4.56", "versionType": "git"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.4.50", "versionType": "git"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.4.23", "versionType": "git"}, {"status": "affected", "version": "8.0.0", "lessThan": "8.1.11", "versionType": "git"}], "packageName": "symfony/http-client", "collectionURL": "https://packagist.org/packages/symfony/http-client", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/symfony/symfony/security/advisories/GHSA-c7hm-wqwp-f9v8", "tags": ["third-party-advisory"]}, {"url": "https://github.com/symfony/symfony/commit/ab084826b2b5db8d0b91af635fe2b5e1c4f699f9", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "The Symfony HttpClient component\u00a0NoPrivateNetworkHttpClient\u00a0does not pin the checked IP address of cached hosts, allowing for DNS rebinding to bypass private network restrictions, resulting in enumeration of internal hosts and ports in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\n\nNoPrivateNetworkHttpClient resolves the host of each request and checks the IP before connecting. It caches the result per host, and passes the IP to the decorated client through the\u00a0resolve option so that the client connects to the exact IP that was checked. The issue is that\u00a0resolve was only passed on the first lookup of a host: on subsequent requests, the decorated client resolved the host again on its own.\n\nAn attacker who controls a host's DNS can exploit this with DNS rebinding by answering the first lookup with a public IP, and subsequent lookups with a private IP, so when an application sends several requests to that host through the same client, the later requests connect to the private IP. This happens, for example, when an application fetches several URLs of a repository provided by a user. The check of the\u00a0primary_ip\u00a0in the\u00a0on_progress\u00a0callback still aborts the request before anything is sent, but the connection is made, and the error differs depending on whether the port is open or closed. This allows enumerating internal hosts and ports, as in CVE-2024-50342.", "supportingMedia": [{"type": "text/html", "value": "<div>The Symfony HttpClient component&nbsp;<code>NoPrivateNetworkHttpClient</code>&nbsp;does not pin the checked IP address of cached hosts, allowing for DNS rebinding to bypass private network restrictions, resulting in enumeration of internal hosts and ports in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.</div><div><code>NoPrivateNetworkHttpClient</code> resolves the host of each request and checks the IP before connecting. It caches the result per host, and passes the IP to the decorated client through the&nbsp;<code>resolve</code> option so that the client connects to the exact IP that was checked. The issue is that&nbsp;<code>resolve</code><span> was only passed on the first lookup of a host: on subsequent requests, the decorated client resolved the host again on its own.</span></div><div>An attacker who controls a host's DNS can exploit this with DNS rebinding by answering the first lookup with a public IP, and subsequent lookups with a private IP, so when an application sends several requests to that host through the same client, the later requests connect to the private IP. This happens, for example, when an application fetches several URLs of a repository provided by a user. The check of the&nbsp;<code>primary_ip</code>&nbsp;in the&nbsp;<code>on_progress</code>&nbsp;callback still aborts the request before anything is sent, but the connection is made, and the error differs depending on whether the port is open or closed. This allows enumerating internal hosts and ports, as in CVE-2024-50342.</div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-367", "description": "CWE-367 Time-of-check time-of-use (TOCTOU) race condition"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side request forgery (SSRF)"}]}], "providerMetadata": {"orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "shortName": "Checkmarx", "dateUpdated": "2026-11-05T12:57:35.267Z"}}}, "cveMetadata": {"cveId": "CVE-2026-123119", "state": "PUBLISHED", "dateUpdated": "2026-11-05T19:03:19.483Z", "dateReserved": "2026-11-05T12:32:19.431Z", "assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "datePublished": "2026-11-05T12:57:35.267Z", "assignerShortName": "Checkmarx"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://packagist.org/packages/symfony/http-client", "defaultStatus": "unaffected", "modules": ["Symfony\\Component\\HttpClient\\NoPrivateNetworkHttpClient"], "packageName": "symfony/http-client", "product": "symfony", "repo": "https://github.com/symfony/http-client", "vendor": "sensiolabs", "versions": [{"lessThan": "5.4.56", "status": "affected", "version": "0", "versionType": "git"}, {"lessThan": "6.4.50", "status": "affected", "version": "6.0.0", "versionType": "git"}, {"lessThan": "7.4.23", "status": "affected", "version": "7.0.0", "versionType": "git"}, {"lessThan": "8.1.11", "status": "affected", "version": "8.0.0", "versionType": "git"}]}], "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Symfony HttpClient component\u00a0NoPrivateNetworkHttpClient\u00a0does not pin the checked IP address of cached hosts, allowing for DNS rebinding to bypass private network restrictions, resulting in enumeration of internal hosts and ports in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\n\nNoPrivateNetworkHttpClient resolves the host of each request and checks the IP before connecting. It caches the result per host, and passes the IP to the decorated client through the\u00a0resolve option so that the client connects to the exact IP that was checked. The issue is that\u00a0resolve was only passed on the first lookup of a host: on subsequent requests, the decorated client resolved the host again on its own.\n\nAn attacker who controls a host's DNS can exploit this with DNS rebinding by answering the first lookup with a public IP, and subsequent lookups with a private IP, so when an application sends several requests to that host through the same client, the later requests connect to the private IP. This happens, for example, when an application fetches several URLs of a repository provided by a user. The check of the\u00a0primary_ip\u00a0in the\u00a0on_progress\u00a0callback still aborts the request before anything is sent, but the connection is made, and the error differs depending on whether the port is open or closed. This allows enumerating internal hosts and ports, as in CVE-2024-50342."}], "id": "CVE-2026-123119", "lastModified": "2026-11-06T21:40:43.450", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-123119", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T14:13:38.399973Z", "version": "2.0.3"}}]}, "published": "2026-11-05T13:17:07.640", "references": [{"source": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "url": "https://github.com/symfony/symfony/commit/ab084826b2b5db8d0b91af635fe2b5e1c4f699f9"}, {"source": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "url": "https://github.com/symfony/symfony/security/advisories/GHSA-c7hm-wqwp-f9v8"}], "sourceIdentifier": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-367"}, {"lang": "en", "value": "CWE-918"}], "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "type": "Secondary"}]}

{"bugzilla": {"description": "symfony/http-client: symfony/http-client: Internal network enumeration via DNS rebinding", "id": "2567770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567770"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-918", "details": ["A flaw was found in the Symfony HttpClient component. The client fails to properly pin verified IP addresses for cached hostnames across subsequent requests, causing the host to be re-resolved. A remote attacker controlling an external Domain Name System (DNS) server can exploit this behavior through DNS rebinding by returning a public IP address on the initial lookup and a private IP address on subsequent queries. This flaw enables the attacker to bypass private network restrictions and enumerate internal hosts and ports."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-123119", "public_date": "2026-11-05T12:57:35Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-123119\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-123119\nhttps://github.com/symfony/symfony/commit/ab084826b2b5db8d0b91af635fe2b5e1c4f699f9\nhttps://github.com/symfony/symfony/security/advisories/GHSA-c7hm-wqwp-f9v8"], "statement": "This vulnerability is rated as having Low impact for Red Hat products because successful exploitation requires precise DNS rebinding conditions and only permits partial network reconnaissance rather than data exfiltration or arbitrary remote code execution. Although an attacker managing authoritative nameservers can manipulate successive domain lookups to circumvent private network restrictions, the client mechanism terminates TCP sessions prior to transmitting any HTTP request payloads. Consequently, the exposure is confined to discerning host availability and open port states via differential connection errors, substantially limiting the threat to internal network discovery.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,5.4.56)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0.0,6.4.50)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.0.0,7.4.23)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,8.1.11)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "symfony", "source": "cna", "vendor": "sensiolabs"}, "product": "symfony", "vendor": "sensiolabs"}], "created": "2026-11-05T14:45:15.070054+00:00", "updated": "2026-11-05T16:00:18.044756+00:00", "vendors": ["sensiolabs", "sensiolabs$PRODUCT$symfony"]}