LowGHSA-9c3x-r3wp-mgxmCVE-2024-50342

Symfony allows internal address and port enumeration by NoPrivateNetworkHttpClient

Published 6 Nov 2024 · Updated 3 Feb 2026

Affected packages

symfony/http-clientComposer
Affected
>=4.3.0 <5.4.47
Fixed in
5.4.47
Update to the fixed version for your release line, for example:composer require symfony/http-client:^5.4.47
symfony/http-clientComposer
Affected
>=6.0.0 <6.4.15
Fixed in
6.4.15
Update to the fixed version for your release line, for example:composer require symfony/http-client:^6.4.15
symfony/http-clientComposer
Affected
>=7.0.0 <7.1.8
Fixed in
7.1.8
Update to the fixed version for your release line, for example:composer require symfony/http-client:^7.1.8
symfony/symfonyComposer
Affected
>=4.3.0 <5.4.47
Fixed in
5.4.47
Update to the fixed version for your release line, for example:composer require symfony/symfony:^5.4.47
symfony/symfonyComposer
Affected
>=6.0.0 <6.4.15
Fixed in
6.4.15
Update to the fixed version for your release line, for example:composer require symfony/symfony:^6.4.15
symfony/symfonyComposer
Affected
>=7.0.0 <7.1.8
Fixed in
7.1.8
Update to the fixed version for your release line, for example:composer require symfony/symfony:^7.1.8

Details

Description

When using the NoPrivateNetworkHttpClient, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration.

Resolution

The NoPrivateNetworkHttpClient now filters blocked IPs earlier to prevent such leaks.

The fisrt patch for this issue is available here for branch 5.4.

The second one is available here for branch 5.4 also.

Credits

We would like to thank Linus Karlsson and Chris Smith for reporting the issue and Nicolas Grekas for providing the fix.

Is GHSA-9c3x-r3wp-mgxm in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected symfony/http-client, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.