CVE-2026-48736: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

PKSA-35by-yxtt-jc85 CVE-2026-48736

Affected version: >=5.4.0,<5.4.53

Reported by:
FriendsOfPHP/security-advisories

[LOW] CVE-2024-50342: Internal address and port enumeration allowed by NoPrivateNetworkHttpClient

PKSA-4k7v-pfvw-nqvp CVE-2024-50342 GHSA-9c3x-r3wp-mgxm

Affected version: >=4.3.0,<4.4.0|>=4.4.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.47|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.15|>=7.0.0,<7.1.0|>=7.1.0,<7.1.8

Reported by:
GitHub, FriendsOfPHP/security-advisories