UpHeron
All vulnerabilities

Servers and applications

CVE-2026-121619

The "private_ranges" Trusted Proxies Shortcut Trusts Clients Presenting an IPv4-Mapped, 6to4, Teredo or NAT64 Address as Reverse Proxies

Severity
Medium 6.3
Published
4 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
7.4.23, 8.1.11
Weakness
Authentication bypass by spoofing (CWE-290)CWE-348
Attack
Over the network · Only under certain conditions · No login needed · No user action needed
Attacker can
Read some data · Change some data
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Also known as
GHSA-xg2q-4rrq-657q
Sources
Project advisories (GitHub)

Description

framework.trusted_proxies: private_ranges, which the deployment documentation recommends, and the private_ranges and PRIVATE_SUBNETS keywords of Request::setTrustedProxies() resolved to IpUtils::PRIVATE_SUBNETS. That constant is the deny list of NoPrivateNetworkHttpClient: it lists the private and special-purpose prefixes a server must not connect to, and since the fix for CVE-2026-48736 it also covers the IPv6 prefixes that embed an IPv4 address: IPv4-mapped (::ffff:0:0/96), IPv4-compatible (::/96), 6to4 (2002::/16), Teredo (2001::/32) and NAT64 (64:ff9b::/96). Over-blocking is safe for a deny list. Used as the allow list of trusted proxies, the same entries trust remote clients.

A client whose connection arrives with such a source address was treated as a reverse proxy, and the X-Forwarded-For, X-Forwarded-Host, X-Forwarded-Proto, X-Forwarded-Port and X-Forwarded-Prefix headers it sends were honoured:

From symfony/symfony's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
SymfonyServers and applications · github:symfony/symfony
  • From 7.1 before 7.4.23
  • From 8 before 8.1.11

References