CVE-2026-121619

The Symfony FrameworkBundle framework.trustedproxies option and the HttpFoundation Request::setTrustedProxies method trust remote clients as reverse proxies when the privateranges shortcut is used, allowing remote attackers to spoof the client IP address, host and scheme in Symfony FrameworkBundl...

EUVD-2026-124613

The Symfony FrameworkBundle framework.trustedproxies option and the HttpFoundation Request::setTrustedProxies method trust remote clients as reverse proxies when the privateranges shortcut is used, allowing remote attackers to spoof the client IP address, host and scheme in Symfony FrameworkBundl...

CVE-2026-121619

The Symfony FrameworkBundle (framework.trusted_proxies option) and HttpFoundation (Request::setTrustedProxies() method) are vulnerable to IP spoofing when the private_ranges shortcut is used. The root cause is that private_ranges resolves to a list that includes IPv6 prefixes embedding IPv4 addre...

CVE-2026-121619 Symfony: The "private_ranges" Trusted Proxies Shortcut Trusts Clients Presenting an IPv4-Mapped, 6to4, Teredo or NAT64 Address as Reverse Proxies

The Symfony FrameworkBundle framework.trustedproxies option and the HttpFoundation Request::setTrustedProxies method trust remote clients as reverse proxies when the privateranges shortcut is used, allowing remote attackers to spoof the client IP address, host and scheme in Symfony FrameworkBundl...