Vulnerability in Symfony FrameworkBundle and HttpFoundation Trust Proxy Settings
CVE-2026-121619

6.3MEDIUM

Key Information:

Vendor

Sensiolabs

Status
Symfony
Vendor
CVE Published:
12 November 2026

What is CVE-2026-121619?

The Symfony FrameworkBundle and HttpFoundation components are vulnerable due to the improper handling of trusted proxies under certain configurations. When utilizing the private_ranges shortcut, remote attackers can spoof the client IP address, host, and protocol. This misconfiguration allows attackers to craft requests that can bypass security measures such as IP allow lists and rate limiting. For instance, a remote client with a spoofed source address can manipulate the X-Forwarded-* headers, resulting in altered responses that could jeopardize data integrity and security. This vulnerability specifically affects versions before the fix implemented in 7.4.23 and 8.1.11, leaving systems open to exploitation if appropriately updated configurations are not made.

Affected Version(s)

symfony 7.1 < 7.4.23

symfony 8.0.0 < 8.1.11

symfony 7.2 < 7.4.23

References

https://github.com/symfony/symfony/security/advisories/GH...
third-party-advisory
https://github.com/symfony/symfony/commit/e109aa54d42678e...
patch

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ivan Tse
Nicolas Grekas
.