Update dependency symfony/http-client to v5.4.53 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
symfony/http-client (source)	5.4.9 → 5.4.53

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Symfony allows internal address and port enumeration by NoPrivateNetworkHttpClient

CVE-2024-50342 / GHSA-9c3x-r3wp-mgxm

More information

Details

Description

When using the NoPrivateNetworkHttpClient, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration.

Resolution

The NoPrivateNetworkHttpClient now filters blocked IPs earlier to prevent such leaks.

The fisrt patch for this issue is available here for branch 5.4.

The second one is available here for branch 5.4 also.

Credits

We would like to thank Linus Karlsson and Chris Smith for reporting the issue and Nicolas Grekas for providing the fix.

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/symfony/symfony/security/advisories/GHSA-9c3x-r3wp-mgxm
• https://github.com/symfony/symfony/commit/296d4b34a33b1a6ca5475c6040b3203622520f5b
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-client/CVE-2024-50342.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2024-50342.yaml
• https://symfony.com/cve-2024-50342
• https://nvd.nist.gov/vuln/detail/CVE-2024-50342
• https://github.com/advisories/GHSA-9c3x-r3wp-mgxm

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

CVE-2026-48736 / GHSA-38cx-cq6f-5755

More information

Details

Description

Symfony\Component\HttpClient\NoPrivateNetworkHttpClient is documented as a decorator that blocks requests to private networks by default. The list of blocked subnets (Symfony\Component\HttpFoundation\IpUtils::PRIVATE_SUBNETS on 6.4+, a private constant in NoPrivateNetworkHttpClient on 5.4) enumerates RFC1918, loopback, link-local and IPv4-mapped IPv6 (::ffff:0:0/96) prefixes, but omits the remaining IPv6 transition forms that can embed a private IPv4 destination: 6to4 (2002::/16, RFC 3056), Teredo (2001::/32, RFC 4380), NAT64 (64:ff9b::/96, RFC 6052 and 64:ff9b:1::/48, RFC 8215) and IPv4-compatible IPv6 (::/96, RFC 4291 §2.5.5.1).

IpUtils::checkIp6() is a pure bitwise CIDR comparison against the constants list and never extracts the embedded IPv4, so an attacker who can supply a URL writes the loopback / RFC1918 IPv4 target as e.g. http://[2002:7f00:1::]/ (6to4 → 127.0.0.1), http://[64:ff9b::7f00:1]/ (NAT64 → 127.0.0.1), http://[::7f00:1]/ (IPv4-compatible → 127.0.0.1) or http://[2001::1]/ (Teredo). IpUtils::isPrivateIp() returns false and NoPrivateNetworkHttpClient dispatches the request.

Real-world reachability of the embedded IPv4 depends on the deploy's IPv6 routing (6to4 tunnel interface, upstream NAT64 gateway, kernel handling of IPv4-compatible addresses), but the security boundary the decorator promises — the dispatch decision — is crossed regardless of whether the packet ultimately lands on the embedded IPv4.

Resolution

The private-subnet list now includes ::/96, 2002::/16, 2001::/32, 64:ff9b::/96 and 64:ff9b:1::/48. Blanket blocking of these prefixes matches the policy applied by Chromium and Mozilla's Private Network Access; server-side HTTPS APIs are not legitimately published on these prefixes.

The patches for this issue are available here for branch 5.4 and here for branch 6.4 (and forward-ported to 7.4, 8.0 and 8.1).

Credits

Symfony would like to thank tonghuaroot for reporting the issue and Nicolas Grekas for providing the fix.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

• https://github.com/symfony/symfony/security/advisories/GHSA-38cx-cq6f-5755
• https://github.com/symfony/symfony/commit/82765368cf74177c36613575182f168a2eb765b2
• https://github.com/symfony/symfony/commit/85b831555be8ea1f43bf01078afe87bc4c92f65e
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-client/CVE-2026-48736.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2026-48736.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-48736.yaml
• https://symfony.com/cve-2026-48736
• https://github.com/advisories/GHSA-38cx-cq6f-5755

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

symfony/http-client (symfony/http-client)

v5.4.53

Compare Source

Changelog (symfony/http-client@v5.4.49...v5.4.53)

• security #cve-2026-48736 Block IPv6 transition forms in NoPrivateNetworkHttpClient (@​nicolas-grekas)

v5.4.49

Compare Source

Changelog (symfony/http-client@v5.4.48...v5.4.49)

• bug symfony/symfony#59023 [HttpClient] Fix streaming and redirecting with NoPrivateNetworkHttpClient (@​nicolas-grekas)

v5.4.48

Compare Source

Changelog (symfony/http-client@v5.4.47...v5.4.48)

• bug symfony/symfony#59013 [HttpClient] Fix checking for private IPs before connecting (@​nicolas-grekas)
• bug symfony/symfony#58562 [HttpClient] Close gracefull when the server closes the connection abruptly (@​discordier)
• bug symfony/symfony#58924 [HttpClient] Fix empty hosts in option "resolve" (@​nicolas-grekas)
• bug symfony/symfony#58915 [HttpClient] Fix option "resolve" with IPv6 addresses (@​nicolas-grekas)
• bug symfony/symfony#58914 [HttpClient] Fix option "bindto" with IPv6 addresses (@​nicolas-grekas)
• bug symfony/symfony#58875 [HttpClient] Removed body size limit (Carl Julian Sauter)
• bug symfony/symfony#58860 [HttpClient] Fix catching some invalid Location headers (@​nicolas-grekas)
• bug symfony/symfony#58836 Work around parse_url() bug (bis) (@​nicolas-grekas)
• bug symfony/symfony#58850 [HttpClient] fix PHP 7.2 compatibility (@​xabbuh)

v5.4.47

Compare Source

Changelog (symfony/http-client@v5.4.46...v5.4.47)

• security symfony/symfony#cve-2024-50342 [HttpClient] Resolve hostnames in NoPrivateNetworkHttpClient (@​nicolas-grekas)

v5.4.46

Compare Source

Changelog (symfony/http-client@v5.4.45...v5.4.46)

• security symfony/symfony#cve-2024-50342 [HttpClient] Filter private IPs before connecting when Host == IP (@​nicolas-grekas)

v5.4.45

Compare Source

Changelog (symfony/http-client@v5.4.44...v5.4.45)

• no significant changes

v5.4.44

Compare Source

Changelog (symfony/http-client@v5.4.43...v5.4.44)

• bug symfony/symfony#58278 [HttpClient] Fix setting CURLMOPT_MAXCONNECTS (@​HypeMC)
• bug symfony/symfony#58218 Work around parse_url() bug (@​nicolas-grekas)

v5.4.43

Compare Source

Changelog (symfony/http-client@v5.4.42...v5.4.43)

• bug symfony/symfony#58044 [HttpClient] Do not overwrite the host to request when using option "resolve" (@​xabbuh)
• bug symfony/symfony#57981 [HttpClient] reject malformed URLs with a meaningful exception (@​xabbuh)
• bug symfony/symfony#57870 [HttpClient] Disable HTTP/2 PUSH by default when using curl (@​nicolas-grekas)

v5.4.42

Compare Source

Changelog (symfony/http-client@v5.4.41...v5.4.42)

• no significant changes

v5.4.41

Compare Source

Changelog (symfony/http-client@v5.4.40...v5.4.41)

• bug symfony/symfony#57569 [HttpClient][Mailer] Revert "Let curl handle transfer encoding", use HTTP/1.1 for Mailgun (@​nicolas-grekas)
• bug symfony/symfony#57453 [HttpClient] Fix parsing SSE (@​fancyweb)

v5.4.40

Compare Source

Changelog (symfony/http-client@v5.4.39...v5.4.40)

• bug symfony/symfony#54860 [HttpClient] Revert fixing curl default options (@​alexandre-daubois)
• bug symfony/symfony#54830 [HttpClient] Fix cURL default options for PHP 8.4 (@​alexandre-daubois)

v5.4.39

Compare Source

Changelog (symfony/http-client@v5.4.38...v5.4.39)

• bug symfony/symfony#54517 [HttpClient] Let curl handle transfer encoding (@​michaelhue)
• bug symfony/symfony#54242 [HttpClient] [EventSourceHttpClient] Fix consuming SSEs with \r\n separator (@​fancyweb)

v5.4.38

Compare Source

Changelog (symfony/http-client@v5.4.37...v5.4.38)

• bug symfony/symfony#54400 [HttpClient] stop all server processes after tests have run (@​xabbuh)
• bug symfony/symfony#54207 [HttpClient] Lazily initialize CurlClientState (@​arjenm)

v5.4.37

Compare Source

Changelog (symfony/http-client@v5.4.36...v5.4.37)

• bug symfony/symfony#54102 [HttpClient] Fix deprecation on PHP 8.3 (@​nicolas-grekas)

v5.4.36

Compare Source

Changelog (symfony/http-client@v5.4.35...v5.4.36)

• bug symfony/symfony#53889 [HttpClient] Make retry strategy work again (@​Nyholm)

v5.4.35

Compare Source

Changelog (symfony/http-client@v5.4.34...v5.4.35)

• bug symfony/symfony#53671 [HttpClient] Fix pausing responses before they start when using curl (@​nicolas-grekas)
• bug symfony/symfony#53506 [HttpClient] Fix error chunk creation in passthru (@​rmikalkenas)

v5.4.34

Compare Source

Changelog (symfony/http-client@v5.4.33...v5.4.34)

• bug symfony/symfony#52864 [HttpClient][Mailer][Process] always pass microseconds to usleep as integers (@​xabbuh)

v5.4.31

Compare Source

Changelog (symfony/http-client@v5.4.30...v5.4.31)

• bug symfony/symfony#52329 [HttpClient] Psr18Client: parse HTTP Reason Phrase for Response (@​Hanmac)

v5.4.29

Compare Source

Changelog (symfony/http-client@v5.4.28...v5.4.29)

• bug symfony/symfony#51659 [HttpClient] Fix TraceableResponse if response has no destruct method (@​maxhelias)

v5.4.26

Compare Source

Changelog (symfony/http-client@v5.4.25...v5.4.26)

• no significant changes

v5.4.25

Compare Source

Changelog (symfony/http-client@v5.4.24...v5.4.25)

• bug symfony/symfony#50728 [HttpClient] Explicitly exclude CURLOPT_POSTREDIR (@​nicolas-grekas)
• bug symfony/symfony#50671 [HttpClient] Fix encoding some characters in query strings (Daniel Kozák)
• bug symfony/symfony#50698 [HttpClient] Fix int conversion for GenericRetryStrategy with floated multiplier (@​francisbesset)

v5.4.24

Compare Source

Changelog (symfony/http-client@v5.4.23...v5.4.24)

• bug symfony/symfony#49063 [Messenger] Respect isRetryable decision of the retry strategy for re-delivery (@​FlyingDR)
• bug symfony/symfony#50256 [HttpClient] Fix setting duplicate-name headers when redirecting with AmpHttpClient (@​nicolas-grekas)
• bug symfony/symfony#50214 [WebProfilerBundle] Remove legacy filters remnants (@​MatTheCat)
• bug symfony/symfony#50235 [HttpClient] Fix getting through proxies via CONNECT (@​nicolas-grekas)
• bug symfony/symfony#49557 [PropertyInfo] Fix phpDocExtractor nullable array value type (@​fabpot)
• bug symfony/symfony#50213 [ErrorHandler] Prevent conflicts with WebProfilerBundle’s JavaScript (@​MatTheCat)
• bug symfony/symfony#50192 [Serializer] backed enum throw notNormalizableValueException outside construct method (@​alli83)
• bug symfony/symfony#50226 [HttpClient] Ensure HttplugClient ignores invalid HTTP headers (@​nicolas-grekas)

v5.4.23

Compare Source

Changelog (symfony/http-client@v5.4.22...v5.4.23)

• bug #​50072 Fix global state preventing two CurlHttpClient instances from working together (nicolas-grekas)
• bug #​50004 fix proxied redirects in curl client (matthi4s)
• bug #​49926 Fix canceling MockResponse (fancyweb)

v5.4.22

Compare Source

Changelog (symfony/http-client@v5.4.21...v5.4.22)

• bug #​49796 Fix not calling the on progress callback when canceling a MockResponse (fancyweb)
• bug #​49722 Encode and decode curly brackets {} (pbowyer)
• bug #​49580 Fix encoding "+" in URLs (nicolas-grekas)

v5.4.21

Compare Source

Changelog (symfony/http-client@v5.4.20...v5.4.21)

• bug #​49299 Fix over-encoding of URL parts to match browser's behavior (nicolas-grekas)
• bug #​49301 Fix data collector (fancyweb)

v5.4.20

Compare Source

Changelog (symfony/http-client@v5.4.19...v5.4.20)

• bug #​49104 Fix collecting data non-late for the profiler (nicolas-grekas)

v5.4.19

Compare Source

Changelog (symfony/http-client@v5.4.18...v5.4.19)

• bug #​48966 Let curl handle content-length headers (nicolas-grekas)
• bug #​48898 Move Http clients data collecting at a late level (pforesi)

v5.4.17

Compare Source

Changelog (symfony/http-client@v5.4.16...v5.4.17)

• bug #​47836 TraceableHttpClient: increase decorator's priority (adpeyre)

v5.4.16

Compare Source

Changelog (symfony/http-client@v5.4.15...v5.4.16)

• bug #​48173 Handle Amp HTTP client v5 incompatibility gracefully (fancyweb)
• bug #​48103 Do not set http_version instead of setting it to null (Tetragramat)

v5.4.15

Compare Source

Changelog (symfony/http-client@v5.4.14...v5.4.15)

• bug #​47990 Fix retrying requests when the content is used by the strategy (nicolas-grekas)
• bug #​47879 Fix buffering after calling AsyncContext::passthru() (nicolas-grekas, lubo13)

v5.4.14

Compare Source

Changelog (symfony/http-client@v5.4.13...v5.4.14)

• bug #​47808 Fix seeking in not-yet-initialized requests (nicolas-grekas)

v5.4.13

Compare Source

Changelog (symfony/http-client@v5.4.12...v5.4.13)

• bug #​47441 Bugfix for delayed retryableHttpClient (martkop26)
• bug #​47415 Psr18Client ignore invalid HTTP headers (nuryagdym)

v5.4.12

Compare Source

Changelog (symfony/http-client@v5.4.11...v5.4.12)

• bug #​47145 Fix shared connections not being freed on PHP < 8 (nicolas-grekas)
• bug #​47143 Fix memory leak when using StreamWrapper (nicolas-grekas)

v5.4.11

Compare Source

Changelog (symfony/http-client@v5.4.10...v5.4.11)

• bug #​47086 Workaround disabled "var_dump" (nicolas-grekas)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.