From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, the NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4‑compatible IPv6, allowing attacker‑supplied URLs to represent private IPv4 targets in forms that IpUtils::isPrivateIp() did not block. When the client processes such a URL, the request is sent to the private IPv4 address, enabling an attacker to reach internal resources. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13. The weakness aligns with CWE‑918 and CWE‑184.

Symfony components symfony:http-client, symfony:http-foundation, and the symfony framework itself are impacted. Versions from 5.4.0 through 5.4.52, from 6.4.0 through 6.4.40, from 7.4.0 through 7.4.12, and from 8.0.0 through 8.0.12 lack the fix.

The CVSS score of 6.9 classifies the issue as moderate severity, while an EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers must supply a crafted URL that the application forwards to NoPrivateNetworkHttpClient. If the application directly uses this client for external requests, an attacker can exploit the bug; otherwise, the risk is mitigated by the absence of that code path. The damage could extend to confidential internal network data and services if the SSRF succeeds.