Is CVE-2026-109449 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109449 being exploited in the wild.

How severe is CVE-2026-109449?

Informational severity, published 15 October 2026.

Which products and versions are affected?

Symfony Expression Language prior to 5.4.54, 6.0-6.4 prior to 6.4.48, 7.0-7.4 prior to 7.4.21, 8.0-8.1 prior to 8.1.9.

How is CVE-2026-109449 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-109449?

Check whether you run Symfony Expression Language at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109449: Symfony Expression Language unbounded parser depth denial of service

CVE-2026-109449 · Severity: info · Published 2026-10-15

Symfony Expression Language, a component used to parse and evaluate dynamic expressions in PHP applications, fails to limit how deeply nested an expression can be. An attacker can submit expressions with tens of thousands of nested operators or property accesses that crash the PHP process when the parser cleans up after itself, denying service to legitimate users. Applications that validate user-supplied expressions are particularly vulnerable.

Vendors: Symfony.

Quick answers

Is CVE-2026-109449 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109449 being exploited in the wild.
How severe is CVE-2026-109449?: Informational severity, published 15 October 2026.
Which products and versions are affected?: Symfony Expression Language prior to 5.4.54, 6.0-6.4 prior to 6.4.48, 7.0-7.4 prior to 7.4.21, 8.0-8.1 prior to 8.1.9.
Is there a fix for CVE-2026-109449?: Yes: fixed in symfony/expression-language 5.4.54, 6.4.48, 7.4.21, 8.1.9. Until then: Restrict parsing of untrusted expressions to trusted sources only, or apply input validation to reject expressions with excessive nesting before passing them to ExpressionLanguage::lint() or compile(). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109449 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-109449?: Check whether you run Symfony Expression Language at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: symfony/expression-language 5.4.54, 6.4.48, 7.4.21, 8.1.9

Restrict parsing of untrusted expressions to trusted sources only, or apply input validation to reject expressions with excessive nesting before passing them to ExpressionLanguage::lint() or compile().

Technical details

The ExpressionLanguage parser recursively builds an abstract syntax tree without enforcing a depth limit on nesting. The vulnerability arises from four iterative loops (binary operator parsing, postfix property access, postfix array access, and conditional operator parsing) that deepen the tree without increasing call stack depth, making a call-stack counter ineffective. Deeply nested expressions parse successfully but trigger a segmentation fault during memory cleanup. The attack requires submitting a malicious expression to any code path that parses untrusted input, including validation via #[Assert\ExpressionSyntax].

Affected products

Symfony Expression Language prior to 5.4.54, 6.0-6.4 prior to 6.4.48, 7.0-7.4 prior to 7.4.21, 8.0-8.1 prior to 8.1.9

Timeline

2026-10-15: disclosed
2026-10-09: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.