https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T05:38:08.091319+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-07863 bdu:2025-07863 2026-10-06T05:38:08.095393+00:00 bdu:2025-07863 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0948 certfr-2024-avi-0948 — De multiples vulnérabilités ont été découvertes dans les produits Symfony. Certaines d'entre elles permettent à un atta… 2026-10-06T05:38:08.095426+00:00 certfr-2024-avi-0948 https://cve.radiocsirt.org/vuln/euvd-2026-199899 EUVD-2026-199899 2026-10-06T05:38:08.095444+00:00 EUVD-2026-199899 https://cve.radiocsirt.org/vuln/fkie_cve-2024-50342 fkie_cve-2024-50342 2026-10-06T05:38:08.095457+00:00

symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the `NoPrivateNetworkHttpClient`, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. As of versions 5.4.46, 6.4.14, and 7.1.7 the `NoPrivateNetworkHttpClient` now filters blocked IPs earlier to prevent such leaks. All users are advised to upgrade. There are no known workarounds for this vulnerability.

 https://cve.radiocsirt.org/vuln/ghsa-9c3x-r3wp-mgxm GHSA-9c3x-r3wp-mgxm — Symfony allows internal address and port enumeration by NoPrivateNetworkHttpClient 2026-10-06T05:38:08.095493+00:00

Affected: Packagist: symfony/http-client, Packagist: symfony/symfony

### Description

When using the `NoPrivateNetworkHttpClient`, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration.

### Resolution

The `NoPrivateNetworkHttpClient` now filters blocked IPs earlier to prevent such leaks.

The fisrt patch for this issue is available [here](https://github.com/symfony/symfony/commit/296d4b34a33b1a6ca5475c6040b3203622520f5b) for branch 5.4.

The second one is available [here](https://github.com/symfony/symfony/commit/b4bf5afdbdcb2fd03da513ee03beeabeb551e5fa) for branch 5.4 also.

### Credits

We would like to thank Linus Karlsson and Chris Smith for reporting the issue and Nicolas Grekas for providing the fix.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-50342 UBUNTU-CVE-2024-50342 2026-10-06T05:38:08.095530+00:00

Affected: Ubuntu:Pro:22.04:LTS: symfony, Ubuntu:Pro:24.04:LTS: symfony, Ubuntu:25.10: symfony, Ubuntu:26.04:LTS: symfony

symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the `NoPrivateNetworkHttpClient`, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. As of versions 5.4.46, 6.4.14, and 7.1.7 the `NoPrivateNetworkHttpClient` now filters blocked IPs earlier to prevent such leaks. All users are advised to upgrade. There are no known workarounds for this vulnerability.