DNS Rebinding Vulnerability in Symfony HttpClient Component

CVE-2026-123119

What is CVE-2026-123119?

The Symfony HttpClient component contains a vulnerability due to improper handling of IP address checks for cached hosts. This flaw allows attackers to leverage DNS rebinding techniques to bypass private network restrictions, which results in the potential enumeration of internal hosts and ports within the affected versions. With this vulnerability, a malicious actor can control the DNS responses and exploit the client’s behavior, leading to a situation where subsequent requests from the application connect to private IP addresses rather than the intended public ones. The issue arises specifically when multiple requests are made through the same client connection, making it possible for attackers to gain unauthorized insights into the network's internal structure.

References