PT-2024-34152 · Symfony+5 · Symfony/Http-Client+5

Cs278 + 1 · Published 2024-10-25 · Updated 2025-10-10 · CVE-2024-50342

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: symfony/http-client versions prior to 5.4.46 symfony/http-client versions prior to 6.4.14 symfony/http-client versions prior to 7.1.7

Description: The issue is related to the NoPrivateNetworkHttpClient in the symfony/http-client module, which is part of the Symphony PHP framework. This module provides methods to fetch HTTP resources synchronously or asynchronously. When using the NoPrivateNetworkHttpClient, some internal information is still leaking during host resolution, leading to possible IP/port enumeration.

Recommendations: For versions prior to 5.4.46, upgrade to version 5.4.46 or later. For versions prior to 6.4.14, upgrade to version 6.4.14 or later. For versions prior to 7.1.7, upgrade to version 7.1.7 or later. As a temporary workaround, consider disabling the NoPrivateNetworkHttpClient until a patch is available.

Exploit

Fix

DoS

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2025-07863

CVE-2024-50342

DSA-5809-1

GHSA-9C3X-R3WP-MGXM

USN-7272-1

Affected Products

Astra Linux

Debian

Linuxmint

Red Os

Ubuntu

Symfony/Http-Client

References · 38

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50342.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2024-50342.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-client/CVE-2024-50342.yaml · Exploit
• https://github.com/symfony/symfony/commit/296d4b34a33b1a6ca5475c6040b3203622520f5b · Patch
• https://github.com/symfony/symfony/security/advisories/GHSA-9c3x-r3wp-mgxm · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-51996 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24895 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-50342 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-50342 · Security Note
• https://ubuntu.com/security/CVE-2024-50345 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5809-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0411SE18 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-07863 · Security Note
• https://ubuntu.com/security/CVE-2024-50340 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24894 · Vendor Advisory