The Symfony NoPrivateNetworkHttpClient fails to maintain the IP address that it checked during DNS resolution for cached host entries. This allows an attacker who controls the DNS for a target domain to perform a DNS rebinding attack: the first DNS lookup returns a public IP, satisfying the initial check, while subsequent lookups resolve to a private IP that lies inside the target network. As the client uses the IP from the first lookup only for the first request, later requests are sent to the private IP, enabling the application to probe internal hosts and open ports. The vulnerability does not provide code execution or privilege escalation; its primary impact is the enumeration of internal network hosts and listening services, which can subsequently aid in further attacks.

This issue affects the Symfony HttpClient component provided by SensioLabs. All Symfony releases older than 5.4.56, 6.4.50, 7.4.23, and 8.1.11 are vulnerable. Users running any of these versions on their applications that use NoPrivateNetworkHttpClient are at risk. The vulnerability is documented in the Symfony GitHub repository under the commit ab084826b2b5db8d0b91af635fe2b5e1c4f699f9 and the public advisory GHSA-c7hm-wqwp-f9v8.

The CVSS base score is 2.3, reflecting a low severity assessment. No EPSS score is published, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, suggesting limited evidence of active exploitation. An attacker would need to control the DNS of a host that the application contacts through the same HttpClient instance. While the scenario is plausible in client‑side or federated situations, the exploitation requires targeted setup, which reduces the likelihood of widespread attacks. Nonetheless, because the vulnerability permits internal network discovery, it can serve as a preliminary reconnaissance step for later, more severe attacks.