Vulnerability · Published Jul 14, 2026 · Assigned by GitHub_M
CVE-2026-45305Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
High 8.7
In plain English
A high-severity regular-expression denial of service in symfony from symfony. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser::cleanup() used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup, allowing crafted input to make parsing hang for an arbitrarily long time. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | symfony | 5.4.53+dfsg-0+deb12u1 | DEBIAN-CVE-2026-45305 |
| Debian:13 | symfony | 6.4.41+dfsg-0+deb13u1 | DEBIAN-CVE-2026-45305 |
| Debian:14 | symfony | 7.4.12+dfsg-1 | DEBIAN-CVE-2026-45305 |
| Packagist | symfony/symfony | 7.4.12 | GHSA-9frc-8383-795m |
| Packagist | symfony/symfony | 8.0.12 | GHSA-9frc-8383-795m |
| Packagist | symfony/symfony | 5.4.52 | GHSA-9frc-8383-795m |
| Packagist | symfony/symfony | 6.4.40 | GHSA-9frc-8383-795m |
| Packagist | symfony/yaml | 5.4.52 | GHSA-9frc-8383-795m |
| Packagist | symfony/yaml | 6.4.40 | GHSA-9frc-8383-795m |
| Packagist | symfony/yaml | 7.4.12 | GHSA-9frc-8383-795m |
| Packagist | symfony/yaml | 8.0.12 | GHSA-9frc-8383-795m |
| Ubuntu:25.10 | symfony | no fix listed | UBUNTU-CVE-2026-45305 |
| Ubuntu:26.04:LTS | symfony | no fix listed | UBUNTU-CVE-2026-45305 |
| Ubuntu:26.10 | symfony | no fix listed | UBUNTU-CVE-2026-45305 |
Affected products (as reported)
Weakness: CWE-1333 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/symfony/symfony/security/advisories/GHSA-9frc-8383-795m x_refsource_CONFIRM
- https://github.com/symfony/symfony/commit/9749cd43c5e09b3735093623670b21b9d8a056cb x_refsource_MISC
- https://github.com/symfony/symfony/releases/tag/v5.4.52 x_refsource_MISC
- https://github.com/symfony/symfony/releases/tag/v6.4.40 x_refsource_MISC
- https://github.com/symfony/symfony/releases/tag/v7.4.12 x_refsource_MISC
- https://github.com/symfony/symfony/releases/tag/v8.0.12 x_refsource_MISC