Search: CVE-2026-48736

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
High	8.6	EPSS 0.6%	CVE-2026-48736Symfony · From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS omitted IPv6 transition prefixes such as High8.6EPSS 0.6%2026-07-14GCVE DatabaseCVE-2026-48736 Symfony PHP framework versions 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13 contain a vulnerability where certain IPv6 transition prefixes were omitted from private IP address checks in the NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS components. This omission allows attacker-supplied URLs to bypass private IP address restrictions. The issue has been fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13. No known exploits in the wild have been reported. EPSS 0.6%Vulnerability	GCVE Database	2026-07-14

Page 1 of 1