Nixpkgs security tracker

Untriaged

Permalink CVE-2026-48736

6.9 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): High (H)
Subsequent System Impact Integrity (SI): Low (L)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): High (H)
Modified Subsequent System Impact Integrity (MSI): Low (L)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 1 day, 14 hours ago Activity log

Created suggestion 1 day, 14 hours ago

Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6, allowing attacker-supplied URLs to represent private IPv4 targets in forms that IpUtils::isPrivateIp() did not block. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.

References

https://github.com/symfony/symfony/security/advisories/GHSA-38cx-cq6f-5755 x_refsource_CONFIRM
https://github.com/symfony/symfony/commit/82765368cf74177c36613575182f168a2eb765b2 x_refsource_MISC
https://github.com/symfony/symfony/commit/85b831555be8ea1f43bf01078afe87bc4c92f65e x_refsource_MISC
https://github.com/symfony/symfony/releases/tag/v5.4.53 x_refsource_MISC
https://github.com/symfony/symfony/releases/tag/v6.4.41 x_refsource_MISC
https://github.com/symfony/symfony/releases/tag/v7.4.13 x_refsource_MISC

Affected products

symfony

==>= 6.0.0-BETA1, < 6.4.41
==>= 5.4.0, < 5.4.53
==>= 7.0.0-BETA1, < 7.4.13
==>= 8.0.0-BETA1, < 8.0.13

http-client

==>= 5.4.0, < 5.4.53

http-foundation

==>= 8.0.0-BETA1, < 8.0.13
==>= 6.0.0-BETA1, < 6.4.41
==>= 7.0.0-BETA1, < 7.4.13

Matching in nixpkgs

pkgs.symfony-cli

Symfony CLI

nixos-unstable 5.17.1
- nixpkgs-unstable 5.17.1
- nixos-unstable-small 5.17.1
nixos-26.05 5.17.1
- nixos-26.05-small 5.17.1
- nixpkgs-26.05-darwin 5.17.1

pkgs.cpp-ipfs-http-client

IPFS C++ API client library

nixos-unstable 0-unstable-2023-06-04
- nixpkgs-unstable 0-unstable-2023-06-04
- nixos-unstable-small 0-unstable-2023-06-04
nixos-26.05 0-unstable-2023-06-04
- nixos-26.05-small 0-unstable-2023-06-04
- nixpkgs-26.05-darwin 0-unstable-2023-06-04

pkgs.haskellPackages.http-client

An HTTP client engine

nixos-unstable 0.7.19
- nixpkgs-unstable 0.7.19
- nixos-unstable-small 0.7.19
nixos-26.05 0.7.19
- nixos-26.05-small 0.7.19
- nixpkgs-26.05-darwin 0.7.19

pkgs.haskellPackages.http-client-tls

http-client backend using the connection package and tls library

nixos-unstable 0.3.6.4
- nixpkgs-unstable 0.3.6.4
- nixos-unstable-small 0.3.6.4
nixos-26.05 0.3.6.4
- nixos-26.05-small 0.3.6.4
- nixpkgs-26.05-darwin 0.3.6.4

pkgs.haskellPackages.http-client-extra

wrapper for http-client exposing cookies

nixos-unstable 0.1.3.0
- nixpkgs-unstable 0.1.3.0
- nixos-unstable-small 0.1.3.0
nixos-26.05 0.1.3.0
- nixos-26.05-small 0.1.3.0
- nixpkgs-26.05-darwin 0.1.3.0

pkgs.haskellPackages.context-http-client

Modify HTTP requests/responses using context

nixos-unstable 0.2.0.2
- nixpkgs-unstable 0.2.0.2
- nixos-unstable-small 0.2.0.2
nixos-26.05 0.2.0.2
- nixos-26.05-small 0.2.0.2
- nixpkgs-26.05-darwin 0.2.0.2

pkgs.haskellPackages.http-client-conduit

Frontend support for using http-client with conduit (deprecated)

nixos-unstable 0.3.0
- nixpkgs-unstable 0.3.0
- nixos-unstable-small 0.3.0
nixos-26.05 0.3.0
- nixos-26.05-small 0.3.0
- nixpkgs-26.05-darwin 0.3.0

pkgs.haskellPackages.http-client-openssl

http-client backend using the OpenSSL library

nixos-unstable 0.3.3
- nixpkgs-unstable 0.3.3
- nixos-unstable-small 0.3.3
nixos-26.05 0.3.3
- nixos-26.05-small 0.3.3
- nixpkgs-26.05-darwin 0.3.3

pkgs.python313Packages.python-http-client

Python HTTP library to call APIs

nixos-unstable 3.3.7
- nixpkgs-unstable 3.3.7
- nixos-unstable-small 3.3.7
nixos-26.05 3.3.7
- nixos-26.05-small 3.3.7
- nixpkgs-26.05-darwin 3.3.7

pkgs.python314Packages.python-http-client

Python HTTP library to call APIs

nixos-unstable 3.3.7
- nixpkgs-unstable 3.3.7
- nixos-unstable-small 3.3.7
nixos-26.05 3.3.7
- nixos-26.05-small 3.3.7
- nixpkgs-26.05-darwin 3.3.7

pkgs.haskellPackages.http-client-multipart

Generate multipart uploads for http-client. (deprecated)

nixos-unstable 0.3.0.0
- nixpkgs-unstable 0.3.0.0
- nixos-unstable-small 0.3.0.0
nixos-26.05 0.3.0.0
- nixos-26.05-small 0.3.0.0
- nixpkgs-26.05-darwin 0.3.0.0

pkgs.haskellPackages.http-client-overrides

HTTP client overrides

nixos-unstable 0.1.1.0
- nixpkgs-unstable 0.1.1.0
- nixos-unstable-small 0.1.1.0
nixos-26.05 0.1.1.0
- nixos-26.05-small 0.1.1.0
- nixpkgs-26.05-darwin 0.1.1.0

pkgs.haskellPackages.http-client-restricted

restricting the servers that http-client will use

nixos-unstable 0.1.0
- nixpkgs-unstable 0.1.0
- nixos-unstable-small 0.1.0
nixos-26.05 0.1.0
- nixos-26.05-small 0.1.0
- nixpkgs-26.05-darwin 0.1.0

pkgs.haskellPackages.http-client-websockets

Glue code for http-client and websockets

nixos-unstable 0.1.1.3
- nixpkgs-unstable 0.1.1.3
- nixos-unstable-small 0.1.1.3
nixos-26.05 0.1.1.3
- nixos-26.05-small 0.1.1.3
- nixpkgs-26.05-darwin 0.1.1.3

pkgs.python313Packages.aiohttp-client-cache

Async persistent cache for aiohttp requests

nixos-unstable 0.14.3
- nixpkgs-unstable 0.14.3
- nixos-unstable-small 0.14.3
nixos-26.05 0.14.3
- nixos-26.05-small 0.14.3
- nixpkgs-26.05-darwin 0.14.3

pkgs.python314Packages.aiohttp-client-cache