porro
Start free trial
Product
Needs attention Checks Setup Updates Alerts Tour the product →
Connectors
Laravel Filament Statamic Craft CMS JavaScript One-click install WordPress · soon All connectors →
Security Pricing

Free tools and reference

Lock-file checker Advisories End of life Blog Log in

Advisories  /  composer  /  symfony

composer

symfony/http-client

Security advisories for symfony/http-client, newest first. 2 known, all fixed. If you’re on 7.1.8 or later, none of them affect you.

RSS feed Check your lock file →

Latest version

8.1.10

Advisories

2 · 0 unfixed

Last advisory

26 May 2026

Safe from

7.1.8

2 advisories · newest first

MODERATE 26 May 2026

CVE-2026-48736: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

PKSA-35by-yxtt-jc85 · CVE-2026-48736

Affected

≥ 5.4.0, < 5.4.53

Fixed in

5.4.53
LOW3.1 13 Nov 2024

CVE-2024-50342: Internal address and port enumeration allowed by NoPrivateNetworkHttpClient

PKSA-4k7v-pfvw-nqvp · CVE-2024-50342

Affected

≥ 4.3.0, < 5.4.47 ≥ 6.0.0, < 6.4.15 ≥ 7.0.0, < 7.1.8

Fixed in

5.4.47 6.4.15 7.1.8
/advisories/composer/symfony/http-client/feed.rss

From Packagist and the GitHub advisory database · synced hourly

Same vendor

symfony/cache3 advisories symfony/dom-crawler1 advisory symfony/error-handler1 advisory symfony/expression-language1 advisory symfony/http-foundation15 advisories symfony/http-kernel8 advisories symfony/mailer1 advisory

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →