# CVE-2026-109413: Symfony YAML stack exhaustion in inline lexer

Source: https://junglewise.ai/threats/cve-2026-109413-in-symfony-yaml-prior-to-versions-5-4-54-6-4-45-7-4-18-and-8-1-6  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109413 · Severity: high · CVSS 4 · Published 2026-10-15

Symfony YAML is a library that parses YAML configuration files used in web applications. An attacker can send a specially crafted YAML document with deeply nested inline structures (like [[[[...]])]) to exhaust the server's stack and crash the process or cause a fatal error. Any application parsing untrusted YAML—such as those accepting YAML-formatted API requests without proper restrictions—is vulnerable to this denial-of-service attack.

Technologies: [symfony/symfony (Packagist)](https://junglewise.ai/threats/technologies/symfony-symfony), [symfony/yaml (Packagist)](https://junglewise.ai/threats/technologies/symfony-yaml), [Symfony Yaml](https://junglewise.ai/threats/technologies/yaml). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Symfony](https://junglewise.ai/threats/vendors/symfony).

## Quick answers

**Is CVE-2026-109413 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109413 being exploited in the wild.

**How severe is CVE-2026-109413?** High severity, with a CVSS score of 4, published 15 October 2026.

**Which products and versions are affected?** symfony/symfony (Packagist) >= 2.0.0, < 5.4.54, ECOSYSTEM:introduced=2.0.0,fixed=5.4.54; symfony/yaml (Packagist) >= 2.0.0, < 5.4.54, ECOSYSTEM:introduced=2.0.0,fixed=5.4.54; Symfony Yaml 5.4.0 to 5.4.53, 6.0.0-BETA1 to 6.4.44, 7.0.0-BETA1 to 7.4.17, 8.0.0-BETA1 to 8.1.5.

**Is there a fix for CVE-2026-109413?** Yes. symfony/symfony (Packagist): upgrade to 5.4.54 or later; symfony/yaml (Packagist): upgrade to 5.4.54 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109413 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-109413?** Check whether you run symfony/symfony (Packagist), symfony/yaml (Packagist) or Symfony Yaml at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- symfony/symfony (Packagist): upgrade to 5.4.54 or later

  ```sh
  composer require symfony/symfony:^5.4.54
  ```

- symfony/yaml (Packagist): upgrade to 5.4.54 or later

  ```sh
  composer require symfony/yaml:^5.4.54
  ```


## Technical details

The Yaml\Parser::lexInlineStructure() method recurses through lexInlineMapping() and lexInlineSequence() for every brace and bracket in inline collections without enforcing the maxNestingLevel guard. This allows an attacker to construct deeply nested YAML input (e.g., hundreds of thousands of levels) that exhausts the call stack during lexing, before the semantic parser's nesting check can intervene. The fix bounds recursion depth at the entry of lexInlineStructure() to match the limit applied elsewhere in the parser.

## Affected products

- Symfony YAML 5.4.0 to 5.4.53, 6.0.0-BETA1 to 6.4.44, 7.0.0-BETA1 to 7.4.17, 8.0.0-BETA1 to 8.1.5

## Identifiers

- CVE-2026-109413
- GHSA-2v3c-qxhr-7vpv

## Timeline

- 2026-10-15: disclosed

## References

- [https://packagist.org/packages/symfony/yaml](https://packagist.org/packages/symfony/yaml)
- [https://github.com/symfony/symfony/pull/65688](https://github.com/symfony/symfony/pull/65688)

## Related threats

- [Symfony Yaml component ReDoS in parser and inline](https://junglewise.ai/threats/cve-2026-123792-the-symfony-yaml-components-inline-and-parser-parse-some-yaml)
- [Symfony HTTP Foundation ReDoS in HeaderUtils::split()](https://junglewise.ai/threats/cve-2026-108082-symfony-is-a-php-framework-for-web-and-console-applications-and)
- [Symfony Routing improper dot-segment encoding in UrlGenerator](https://junglewise.ai/threats/cve-2026-48784-symfony-routing-improper-dot-segment-encoding-in-urlgenerator)
- [Symfony HtmlSanitizer XSS via incomplete URL attribute sanitization](https://junglewise.ai/threats/cve-2026-48761-symfony-htmlsanitizer-xss-via-incomplete-url-attribute)
- [Symfony HtmlSanitizer visual spoofing via percent-encoded BiDi characters](https://junglewise.ai/threats/cve-2026-48760-symfony-htmlsanitizer-visual-spoofing-via-percent-encoded-bidi)