CVE-2026-109413highCWE-674

CVE-2026-109413: high-severity vulnerability in sensiolabs symfony

Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process

Published

Follow this CVE+ Monitor symfony+ Monitor symfony

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.4%
In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A document made of deeply nested inline collections, such as [[[[...]]]], exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error. Any code parsing untrusted YAML is affected. That includes #[MapRequestPayload] when the Yaml component is installed and the endpoint does not restrict acceptFormat: a single unauthenticated request with a YAML content type is enough. This issue affects symfony/yaml through v5.4.53, v6.0.0-BETA1 through v6.4.44, v7.0.0-BETA1 through v7.4.17, and v8.0.0-BETA1 through v8.1.5.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
sensiolabs · symfony
Related CVEs — sensiolabs symfony

In the same product, most dangerous first.

CVE-2026-108082HIGHSymfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request HeaderEPSS 0.5%CVE-2026-109449HIGHSymfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the ProcessEPSS 0.4%CVE-2026-118517LOWSymfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority (Incomplete Fix for CVE-2026-45066)EPSS —CVE-2026-123125MEDIUMSymfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter BypassEPSS —CVE-2026-123119LOWSymfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)EPSS —CVE-2026-121971HIGHSymfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path ReferencesEPSS —