What’s Vulnerable › Vulnerabilities

CVE-2023-49094: Symbolicator Server Side Request Forgery vulnerability

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-11-30 · updated 2026-06-17
• Weakness: CWE-918

Description

Symbolicator is a symbolication service for native stacktraces and minidumps with symbol server support. An attacker could make Symbolicator send arbitrary GET HTTP requests to internal IP addresses by using a specially crafted HTTP endpoint. The response could be reflected to the attacker if they have an account on Sentry instance. The issue has been fixed in the release 23.11.2.

Affected products

• getsentry symbolicator: from 0.3.3 before 23.11.2 — fixed in 23.11.2

How to fix

Upgrade to a fixed version: getsentry symbolicator 23.11.2. Check the vendor advisory for mitigations.

References

• https://github.com/getsentry/symbolicator/commit/9db2fb9197dd200d62aacebd8efef4df7678865a
• https://github.com/getsentry/symbolicator/pull/1332
• https://github.com/getsentry/symbolicator/releases/tag/23.11.2
• https://github.com/getsentry/symbolicator/security/advisories/GHSA-6576-pr6j-h9c6
• https://github.com/getsentry/symbolicator/commit/9db2fb9197dd200d62aacebd8efef4df7678865a
• https://github.com/getsentry/symbolicator/pull/1332
• https://github.com/getsentry/symbolicator/releases/tag/23.11.2
• https://github.com/getsentry/symbolicator/security/advisories/GHSA-6576-pr6j-h9c6

Get alerted when CVE-2023-49094 or the next vulnerability affects your stack