CVE-2026-123125

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123125", "assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "state": "PUBLISHED", "assignerShortName": "Checkmarx", "dateReserved": "2026-11-05T13:05:37.986Z", "datePublished": "2026-11-05T15:55:11.297Z", "dateUpdated": "2026-11-05T17:00:21.546Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "shortName": "Checkmarx", "dateUpdated": "2026-11-05T15:55:11.297Z"}, "title": "Symfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter Bypass", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-184", "description": "CWE-184 Incomplete list of disallowed inputs", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-918", "description": "CWE-918 Server-Side request forgery (SSRF)", "type": "CWE"}]}], "affected": [{"vendor": "sensiolabs", "product": "symfony", "collectionURL": "https://packagist.org/packages/symfony/validator", "packageName": "symfony/validator", "repo": "https://github.com/symfony/validator", "modules": ["Symfony/Component/Validator/Constraints/IpValidator"], "versions": [{"status": "affected", "version": "0", "lessThan": "5.4.56", "versionType": "git"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.4.50", "versionType": "git"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.4.23", "versionType": "git"}, {"status": "affected", "version": "8.0.0", "lessThan": "8.1.11", "versionType": "git"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "5.4.56"}, {"vulnerable": true, "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.0", "versionEndExcluding": "6.4.50"}, {"vulnerable": true, "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.0", "versionEndExcluding": "7.4.23"}, {"vulnerable": true, "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.0.0", "versionEndExcluding": "8.1.11"}]}]}], "descriptions": [{"lang": "en", "value": "The Symfony Validator component\u00a0IpValidator\u00a0incompletely classifies internal addresses in the filtered modes of the\u00a0Ip\u00a0constraint, so some internal addresses are accepted as public, which can lead to Server-Side Request Forgery (SSRF) in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\n\nIn these modes,\u00a0IpValidator\u00a0relies on the PHP flags\u00a0FILTER_FLAG_NO_PRIV_RANGE\u00a0and\u00a0FILTER_FLAG_NO_RES_RANGE\u00a0to classify addresses as public, private, or reserved. These flags do not cover shared address space (100.64.0.0/10) or IPv4-mapped, IPv4-compatible, and 6to4 IPv6 addresses, which can embed internal IPv4 addresses. A value such as ::ffff:127.0.0.1\u00a0can therefore pass validation even though it points to an internal host.\nApplications that rely on the\u00a0Ip\u00a0constraint to reject internal addresses, for example before making a server-side request to a user-supplied address, can be exposed to SSRF.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>The Symfony Validator component&nbsp;<code>IpValidator</code>&nbsp;incompletely classifies internal addresses in the filtered modes of the&nbsp;<code>Ip</code>&nbsp;constraint, so some internal addresses are accepted as public, which can lead to Server-Side Request Forgery (SSRF) in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.</div><div>In these modes,&nbsp;<code>IpValidator</code>&nbsp;relies on the PHP flags&nbsp;<code>FILTER_FLAG_NO_PRIV_RANGE</code>&nbsp;and&nbsp;<code>FILTER_FLAG_NO_RES_RANGE</code>&nbsp;to classify addresses as public, private, or reserved. These flags do not cover shared address space (<code>100.64.0.0/10</code>) or IPv4-mapped, IPv4-compatible, and 6to4 IPv6 addresses, which can embed internal IPv4 addresses. A value such as :<code>:ffff:127.0.0.1</code>&nbsp;can therefore pass validation even though it points to an internal host.<br>Applications that rely on the&nbsp;<code>Ip</code>&nbsp;constraint to reject internal addresses, for example before making a server-side request to a user-supplied address, can be exposed to SSRF.</div>"}]}], "references": [{"url": "https://github.com/symfony/symfony/security/advisories/GHSA-4qpf-57w4-m3wc", "tags": ["third-party-advisory"]}, {"url": "https://github.com/symfony/symfony/commit/3bf8ea37fcb402c5ecc502a3f63012df85a7572e", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}}], "credits": [{"lang": "en", "value": "zx (Jace)", "type": "finder"}, {"lang": "en", "value": "Nicolas Grekas", "type": "remediation developer"}], "source": {"advisory": "GHSA-4qpf-57w4-m3wc", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T16:58:59.042475Z", "id": "CVE-2026-123125", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T17:00:21.546Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-123125", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T16:58:59.042475Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T16:56:42.659Z"}}], "cna": {"title": "Symfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter Bypass", "source": {"advisory": "GHSA-4qpf-57w4-m3wc", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "zx (Jace)"}, {"lang": "en", "type": "remediation developer", "value": "Nicolas Grekas"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/symfony/validator", "vendor": "sensiolabs", "modules": ["Symfony/Component/Validator/Constraints/IpValidator"], "product": "symfony", "versions": [{"status": "affected", "version": "0", "lessThan": "5.4.56", "versionType": "git"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.4.50", "versionType": "git"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.4.23", "versionType": "git"}, {"status": "affected", "version": "8.0.0", "lessThan": "8.1.11", "versionType": "git"}], "packageName": "symfony/validator", "collectionURL": "https://packagist.org/packages/symfony/validator", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/symfony/symfony/security/advisories/GHSA-4qpf-57w4-m3wc", "tags": ["third-party-advisory"]}, {"url": "https://github.com/symfony/symfony/commit/3bf8ea37fcb402c5ecc502a3f63012df85a7572e", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "The Symfony Validator component\u00a0IpValidator\u00a0incompletely classifies internal addresses in the filtered modes of the\u00a0Ip\u00a0constraint, so some internal addresses are accepted as public, which can lead to Server-Side Request Forgery (SSRF) in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\n\nIn these modes,\u00a0IpValidator\u00a0relies on the PHP flags\u00a0FILTER_FLAG_NO_PRIV_RANGE\u00a0and\u00a0FILTER_FLAG_NO_RES_RANGE\u00a0to classify addresses as public, private, or reserved. These flags do not cover shared address space (100.64.0.0/10) or IPv4-mapped, IPv4-compatible, and 6to4 IPv6 addresses, which can embed internal IPv4 addresses. A value such as ::ffff:127.0.0.1\u00a0can therefore pass validation even though it points to an internal host.\nApplications that rely on the\u00a0Ip\u00a0constraint to reject internal addresses, for example before making a server-side request to a user-supplied address, can be exposed to SSRF.", "supportingMedia": [{"type": "text/html", "value": "<div>The Symfony Validator component&nbsp;<code>IpValidator</code>&nbsp;incompletely classifies internal addresses in the filtered modes of the&nbsp;<code>Ip</code>&nbsp;constraint, so some internal addresses are accepted as public, which can lead to Server-Side Request Forgery (SSRF) in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.</div><div>In these modes,&nbsp;<code>IpValidator</code>&nbsp;relies on the PHP flags&nbsp;<code>FILTER_FLAG_NO_PRIV_RANGE</code>&nbsp;and&nbsp;<code>FILTER_FLAG_NO_RES_RANGE</code>&nbsp;to classify addresses as public, private, or reserved. These flags do not cover shared address space (<code>100.64.0.0/10</code>) or IPv4-mapped, IPv4-compatible, and 6to4 IPv6 addresses, which can embed internal IPv4 addresses. A value such as :<code>:ffff:127.0.0.1</code>&nbsp;can therefore pass validation even though it points to an internal host.<br>Applications that rely on the&nbsp;<code>Ip</code>&nbsp;constraint to reject internal addresses, for example before making a server-side request to a user-supplied address, can be exposed to SSRF.</div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-184", "description": "CWE-184 Incomplete list of disallowed inputs"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side request forgery (SSRF)"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.56", "versionStartIncluding": "0"}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.4.50", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.4.23", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "8.1.11", "versionStartIncluding": "8.0.0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "shortName": "Checkmarx", "dateUpdated": "2026-11-05T15:55:11.297Z"}}}, "cveMetadata": {"cveId": "CVE-2026-123125", "state": "PUBLISHED", "dateUpdated": "2026-11-05T17:00:21.546Z", "dateReserved": "2026-11-05T13:05:37.986Z", "assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "datePublished": "2026-11-05T15:55:11.297Z", "assignerShortName": "Checkmarx"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://packagist.org/packages/symfony/validator", "defaultStatus": "unaffected", "modules": ["Symfony/Component/Validator/Constraints/IpValidator"], "packageName": "symfony/validator", "product": "symfony", "repo": "https://github.com/symfony/validator", "vendor": "sensiolabs", "versions": [{"lessThan": "5.4.56", "status": "affected", "version": "0", "versionType": "git"}, {"lessThan": "6.4.50", "status": "affected", "version": "6.0.0", "versionType": "git"}, {"lessThan": "7.4.23", "status": "affected", "version": "7.0.0", "versionType": "git"}, {"lessThan": "8.1.11", "status": "affected", "version": "8.0.0", "versionType": "git"}]}], "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Symfony Validator component\u00a0IpValidator\u00a0incompletely classifies internal addresses in the filtered modes of the\u00a0Ip\u00a0constraint, so some internal addresses are accepted as public, which can lead to Server-Side Request Forgery (SSRF) in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\n\nIn these modes,\u00a0IpValidator\u00a0relies on the PHP flags\u00a0FILTER_FLAG_NO_PRIV_RANGE\u00a0and\u00a0FILTER_FLAG_NO_RES_RANGE\u00a0to classify addresses as public, private, or reserved. These flags do not cover shared address space (100.64.0.0/10) or IPv4-mapped, IPv4-compatible, and 6to4 IPv6 addresses, which can embed internal IPv4 addresses. A value such as ::ffff:127.0.0.1\u00a0can therefore pass validation even though it points to an internal host.\nApplications that rely on the\u00a0Ip\u00a0constraint to reject internal addresses, for example before making a server-side request to a user-supplied address, can be exposed to SSRF."}], "id": "CVE-2026-123125", "lastModified": "2026-11-06T21:40:43.450", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-123125", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T16:58:59.042475Z", "version": "2.0.3"}}]}, "published": "2026-11-05T16:17:46.940", "references": [{"source": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "url": "https://github.com/symfony/symfony/commit/3bf8ea37fcb402c5ecc502a3f63012df85a7572e"}, {"source": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "url": "https://github.com/symfony/symfony/security/advisories/GHSA-4qpf-57w4-m3wc"}], "sourceIdentifier": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-184"}, {"lang": "en", "value": "CWE-918"}], "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "type": "Secondary"}]}

{"bugzilla": {"description": "symfony/validator: Symfony Validator: Server-Side Request Forgery via incomplete IP address validation", "id": "2567709", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567709"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-184", "details": ["A flaw was found in the Symfony Validator component. The IP address validator improperly classifies certain internal and reserved network addresses as public, such as shared address spaces and IPv6 addresses embedding internal IPv4 addresses. A remote attacker can exploit this flaw by submitting specially crafted IP addresses to bypass validation, potentially leading to Server-Side Request Forgery (SSRF) and unauthorized access to internal network resources."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-123125", "public_date": "2026-11-05T15:55:11Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-123125\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-123125\nhttps://github.com/symfony/symfony/commit/3bf8ea37fcb402c5ecc502a3f63012df85a7572e\nhttps://github.com/symfony/symfony/security/advisories/GHSA-4qpf-57w4-m3wc"], "statement": "This vulnerability is rated as Moderate severity rather than Important because successful exploitation requires an application to specifically employ Symfony's IP constraint filters as an SSRF boundary check for user-supplied target addresses. In standard environments, Symfony libraries are not automatically configured to act as network firewalls or gateways, limiting the scope to custom application endpoints that make outbound requests based on validated input. While an attacker can submit alternate address notations to evade the internal range blocklist, any potential impact remains confined to the internal network exposure and services accessible from the hosting application.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,5.4.56)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0.0,6.4.50)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.0.0,7.4.23)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,8.1.11)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "inferred", "scores": [{"score": 100.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "symfony", "source": "cna", "vendor": "sensiolabs"}, "product": "symfony", "vendor": "sensiolabs"}], "created": "2026-11-05T17:45:06.312600+00:00", "updated": "2026-11-05T18:00:20.446511+00:00", "vendors": ["sensiolabs", "sensiolabs$PRODUCT$symfony"]}