CVE-2026-121619

The Symfony FrameworkBundle framework.trustedproxies option and the HttpFoundation Request::setTrustedProxies method trust remote clients as reverse proxies when the privateranges shortcut is used, allowing remote attackers to spoof the client IP address, host and scheme in Symfony FrameworkBundl...

EUVD-2026-124613

The Symfony FrameworkBundle framework.trustedproxies option and the HttpFoundation Request::setTrustedProxies method trust remote clients as reverse proxies when the privateranges shortcut is used, allowing remote attackers to spoof the client IP address, host and scheme in Symfony FrameworkBundl...

CVE-2026-121619

The Symfony FrameworkBundle (framework.trusted_proxies option) and HttpFoundation (Request::setTrustedProxies() method) are vulnerable to IP spoofing when the private_ranges shortcut is used. The root cause is that private_ranges resolves to a list that includes IPv6 prefixes embedding IPv4 addre...

PT-2026-145999

The Symfony FrameworkBundle framework.trusted proxies option and the HttpFoundation Request::setTrustedProxies method trust remote clients as reverse proxies when the private ranges shortcut is used, allowing remote attackers to spoof the client IP address, host and scheme in Symfony...