Is CVE-2026-109413 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109413 being exploited in the wild.

How severe is CVE-2026-109413?

High severity, with a CVSS score of 4, published 15 October 2026.

Which products and versions are affected?

symfony/symfony (Packagist) >= 2.0.0, = 2.0.0, < 5.4.54, ECOSYSTEM:introduced=2.0.0,fixed=5.4.54; Symfony Yaml 5.4.0 to 5.4.53, 6.0.0-BETA1 to 6.4.44, 7.0.0-BETA1 to 7.4.17, 8.0.0-BETA1 to 8.1.5.

Is there a fix for CVE-2026-109413?

Yes. symfony/symfony (Packagist): upgrade to 5.4.54 or later; symfony/yaml (Packagist): upgrade to 5.4.54 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-109413 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-109413?

Check whether you run symfony/symfony (Packagist), symfony/yaml (Packagist) or Symfony Yaml at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109413: Symfony YAML stack exhaustion in inline lexer

Q: Is there a fix for CVE-2026-109413?

Yes. symfony/symfony (Packagist): upgrade to 5.4.54 or later; symfony/yaml (Packagist): upgrade to 5.4.54 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-109413 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-109413?

Check whether you run symfony/symfony (Packagist), symfony/yaml (Packagist) or Symfony Yaml at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109413 · Severity: high · CVSS 4 · Published 2026-10-15

Symfony YAML is a library that parses YAML configuration files used in web applications. An attacker can send a specially crafted YAML document with deeply nested inline structures (like [[[[...]])]) to exhaust the server's stack and crash the process or cause a fatal error. Any application parsing untrusted YAML—such as those accepting YAML-formatted API requests without proper restrictions—is vulnerable to this denial-of-service attack.

Technologies: symfony/symfony (Packagist), symfony/yaml (Packagist), Symfony Yaml. Vendors: Packagist, Symfony.

Quick answers

Is CVE-2026-109413 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109413 being exploited in the wild.
How severe is CVE-2026-109413?: High severity, with a CVSS score of 4, published 15 October 2026.
Which products and versions are affected?: symfony/symfony (Packagist) >= 2.0.0, < 5.4.54, ECOSYSTEM:introduced=2.0.0,fixed=5.4.54; symfony/yaml (Packagist) >= 2.0.0, < 5.4.54, ECOSYSTEM:introduced=2.0.0,fixed=5.4.54; Symfony Yaml 5.4.0 to 5.4.53, 6.0.0-BETA1 to 6.4.44, 7.0.0-BETA1 to 7.4.17, 8.0.0-BETA1 to 8.1.5.
Is there a fix for CVE-2026-109413?: Yes. symfony/symfony (Packagist): upgrade to 5.4.54 or later; symfony/yaml (Packagist): upgrade to 5.4.54 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109413 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-109413?: Check whether you run symfony/symfony (Packagist), symfony/yaml (Packagist) or Symfony Yaml at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

symfony/symfony (Packagist): upgrade to 5.4.54 or later
```
composer require symfony/symfony:^5.4.54
```
symfony/yaml (Packagist): upgrade to 5.4.54 or later
```
composer require symfony/yaml:^5.4.54
```

Technical details

The Yaml\Parser::lexInlineStructure() method recurses through lexInlineMapping() and lexInlineSequence() for every brace and bracket in inline collections without enforcing the maxNestingLevel guard. This allows an attacker to construct deeply nested YAML input (e.g., hundreds of thousands of levels) that exhausts the call stack during lexing, before the semantic parser's nesting check can intervene. The fix bounds recursion depth at the entry of lexInlineStructure() to match the limit applied elsewhere in the parser.

Affected products

Symfony YAML 5.4.0 to 5.4.53, 6.0.0-BETA1 to 6.4.44, 7.0.0-BETA1 to 7.4.17, 8.0.0-BETA1 to 8.1.5

Identifiers

CVE-2026-109413
GHSA-2v3c-qxhr-7vpv

Timeline

2026-10-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.