What’s Vulnerable › Vulnerabilities

CVE-2024-50342: Internal address and port enumeration allowed by NoPrivateNetworkHttpClient in symfony/http-client

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-06 · updated 2026-06-17
• Weakness: CWE-200

Description

symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the `NoPrivateNetworkHttpClient`, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. As of versions 5.4.46, 6.4.14, and 7.1.7 the `NoPrivateNetworkHttpClient` now filters blocked IPs earlier to prevent such leaks. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

• Sensiolabs Httpclient: before 5.4.46; from 6.0.0 before 6.4.14; from 7.0.0 before 7.1.7 — fixed in 5.4.46, 6.4.14, 7.1.7

How to fix

Upgrade to a fixed version: Sensiolabs Httpclient 5.4.46, 6.4.14, 7.1.7. Check the vendor advisory for mitigations.

References

• https://github.com/symfony/symfony/commit/296d4b34a33b1a6ca5475c6040b3203622520f5b
• https://github.com/symfony/symfony/security/advisories/GHSA-9c3x-r3wp-mgxm

Get alerted when CVE-2024-50342 or the next vulnerability affects your stack