Symfony's NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS components omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6 in their private IP address checks. This omission allowed attacker-supplied URLs to represent private IPv4 targets in forms that the IpUtils::isPrivateIp() method did not block, potentially bypassing network access restrictions. The vulnerability affects Symfony versions from 5.4.0 up to but not including 5.4.53, 6.4.41, 7.4.13, and 8.0.13, where the issue was fixed. The affected Ubuntu package versions include multiple specific versions across Ubuntu 16.04 LTS through Ubuntu 26.04 LTS and Ubuntu Pro releases. There are no known exploits in the wild, and the vulnerability has a CVSS 4.0 vector indicating network attack vector, low attack complexity, partial attack traceability, and high scope impact.

The vulnerability allows an attacker to bypass private IP address filtering by using IPv6 transition prefixes to represent private IPv4 addresses in URLs. This could lead to unauthorized access to internal network resources that are intended to be protected by private network checks. However, no known exploits have been reported in the wild, and the impact depends on the use of the affected Symfony components in network access control scenarios.

The issue is fixed in Symfony versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13. Users should upgrade to these or later versions to remediate the vulnerability. Since this is not a cloud service, manual patching is required. Check the vendor or Ubuntu security advisories for updated package versions corresponding to these fixed releases and apply them accordingly.