Search for packages
Package details: pkg:composer/symfony/http-client@5.4.47
purl pkg:composer/symfony/http-client@5.4.47
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-267p-fu2q-hyd1 Symfony allows internal address and port enumeration by NoPrivateNetworkHttpClient ### Description When using the `NoPrivateNetworkHttpClient`, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. ### Resolution The `NoPrivateNetworkHttpClient` now filters blocked IPs earlier to prevent such leaks. The fisrt patch for this issue is available [here](https://github.com/symfony/symfony/commit/296d4b34a33b1a6ca5475c6040b3203622520f5b) for branch 5.4. The second one is available [here](https://github.com/symfony/symfony/commit/b4bf5afdbdcb2fd03da513ee03beeabeb551e5fa) for branch 5.4 also. ### Credits We would like to thank Linus Karlsson and Chris Smith for reporting the issue and Nicolas Grekas for providing the fix. CVE-2024-50342
GHSA-9c3x-r3wp-mgxm

Date Actor Action Vulnerability Source VulnerableCode Version
2025-07-03T13:57:23.505987+00:00 GitLab Importer Fixing VCID-267p-fu2q-hyd1 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/symfony/http-client/CVE-2024-50342.yml 36.1.3
2025-07-01T14:35:46.931760+00:00 GHSA Importer Fixing VCID-267p-fu2q-hyd1 https://github.com/advisories/GHSA-9c3x-r3wp-mgxm 36.1.3
2025-07-01T12:10:41.207062+00:00 GithubOSV Importer Fixing VCID-267p-fu2q-hyd1 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-9c3x-r3wp-mgxm/GHSA-9c3x-r3wp-mgxm.json 36.1.3