Sensiolabs

CVE-2026-121619: The Symfony FrameworkBundle framework.trusted_proxies option and the HttpFoundation Request::setTrustedProxies() method trust remote clients as reverse proxies

CVE-2026-121619 Nov 12, 2026 Source: Vendor

The Symfony FrameworkBundle framework.trusted_proxies option and the HttpFoundation Request::setTrustedProxies() method trust remote clients as reverse proxies when the private_ranges shortcut is used, allowing remote attackers to spoof the client IP address, host and scheme in Symfony FrameworkBundle versions 7.1 prior to 7.4.23 and 8.x prior to 8.1.11, and HttpFoundation versions 7.2 prior to 7.4.23 and 8.x prior to 8.1.11. The private_ranges and PRIVATE_SUBNETS keywords resolved to IpUtils::P

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-121619

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

1 line

Showing 1–1 of 1

CVE-2026-121619 BR2026-0000-047909 unclaimed

Credited as Ivan Tse