Vulnerability · Published Oct 15, 2026 · Assigned by Checkmarx
CVE-2026-109413Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process
High 8.7
In plain English
A high-severity security flaw in symfony from sensiolabs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A document made of deeply nested inline collections, such as [[[[...]]]], exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error. Any code parsing untrusted YAML is affected. That includes #[MapRequestPayload] when the Yaml component is installed and the endpoint does not restrict acceptFormat: a single unauthenticated request with a YAML content type is enough. This issue affects symfony/yaml through v5.4.53, v6.0.0-BETA1 through v6.4.44, v7.0.0-BETA1 through v7.4.17, and v8.0.0-BETA1 through v8.1.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | symfony | no fix listed | DEBIAN-CVE-2026-109413 |
| Debian:13 | symfony | 6.4.49+dfsg-0+deb13u1 | DEBIAN-CVE-2026-109413 |
| Debian:14 | symfony | 7.4.18+dfsg-1 | DEBIAN-CVE-2026-109413 |
| Packagist | symfony/symfony | 8.1.6 | GHSA-2v3c-qxhr-7vpv |
| Packagist | symfony/symfony | 6.4.45 | GHSA-2v3c-qxhr-7vpv |
| Packagist | symfony/symfony | 7.4.18 | GHSA-2v3c-qxhr-7vpv |
| Packagist | symfony/symfony | 5.4.54 | GHSA-2v3c-qxhr-7vpv |
| Packagist | symfony/yaml | 7.4.18 | GHSA-2v3c-qxhr-7vpv |
| Packagist | symfony/yaml | 5.4.54 | GHSA-2v3c-qxhr-7vpv |
| Packagist | symfony/yaml | 6.4.45 | GHSA-2v3c-qxhr-7vpv |
| Packagist | symfony/yaml | 8.1.6 | GHSA-2v3c-qxhr-7vpv |
| Ubuntu:26.04:LTS | symfony | no fix listed | UBUNTU-CVE-2026-109413 |
| Ubuntu:26.10 | symfony | no fix listed | UBUNTU-CVE-2026-109413 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| sensiolabs | symfony | 0 – before v5.4.54v6.0.0-BETA1 – before v6.4.45v7.0.0-BETA1 – before v7.4.18v8.0.0-BETA1 – before v8.1.6 |
Weakness: CWE-674 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N