CVE-2026-123125
Description
A flaw was found in the Symfony Validator component. The IP address validator improperly classifies certain internal and reserved network addresses as public, such as shared address spaces and IPv6 addresses embedding internal IPv4 addresses. A remote attacker can exploit this flaw by submitting specially crafted IP addresses to bypass validation, potentially leading to Server-Side Request Forgery (SSRF) and unauthorized access to internal network resources.
Statement
This vulnerability is rated as Moderate severity rather than Important because successful exploitation requires an application to specifically employ Symfony's IP constraint filters as an SSRF boundary check for user-supplied target addresses. In standard environments, Symfony libraries are not automatically configured to act as network firewalls or gateways, limiting the scope to custom application endpoints that make outbound requests based on validated input. While an attacker can submit alternate address notations to evade the internal range blocklist, any potential impact remains confined to the internal network exposure and services accessible from the hosting application.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Attackers may be able to find other malicious inputs that were not expected by the developer, allowing them to bypass the intended protection mechanism.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
