# CVE-2026-123792: Symfony Yaml component ReDoS in parser and inline

Source: https://junglewise.ai/threats/cve-2026-123792-the-symfony-yaml-components-inline-and-parser-parse-some-yaml  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-123792 · Severity: info · Published 2026-11-06

Symfony's YAML parser can be forced to process specially crafted YAML documents extremely slowly, consuming CPU time and potentially causing service outages. Any PHP application using Symfony to parse untrusted YAML input—including web endpoints accepting YAML-formatted requests—is vulnerable to denial-of-service attacks where a single malicious document ties up the server for minutes.

Technologies: [Symfony Yaml](https://junglewise.ai/threats/technologies/yaml). Vendors: [Symfony](https://junglewise.ai/threats/vendors/symfony).

## Quick answers

**Is CVE-2026-123792 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123792 being exploited in the wild.

**How severe is CVE-2026-123792?** Informational severity, published 6 November 2026.

**Which products and versions are affected?** Symfony Yaml prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, 8.x prior to 8.1.11.

**Is there a fix for CVE-2026-123792?** Yes: fixed in Symfony Yaml 5.4.56, 6.4.50, 7.4.23, 8.1.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123792 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-123792?** Check whether you run Symfony Yaml at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Symfony Yaml 5.4.56, 6.4.50, 7.4.23, 8.1.11

## Technical details

The Symfony Yaml parser's Inline and Parser components contain algorithmic inefficiencies: embedded mappings in flow sequences are reparsed for each scalar, causing exponential time growth with nesting depth; pattern matching for keys and tags rescans whitespace quadratically; and flow collection scalars are matched against the entire remaining collection. Authentication is not required; the attack vector is any YAML parsing of untrusted input, including HTTP endpoints decorated with #[MapRequestPayload] that accept YAML content types.

## Affected products

- Symfony Yaml prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, 8.x prior to 8.1.11

## Timeline

- 2026-11-06: disclosed

## Related threats

- [Symfony YAML stack exhaustion in inline lexer](https://junglewise.ai/threats/cve-2026-109413-in-symfony-yaml-prior-to-versions-5-4-54-6-4-45-7-4-18-and-8-1-6)
- [Symfony Yaml ReDoS in Parser cleanup](https://junglewise.ai/threats/cve-2026-45305-symfony-yaml-redos-in-parser-cleanup)
- [Symfony Yaml denial of service via recursive alias expansion](https://junglewise.ai/threats/cve-2026-45304-symfony-yaml-denial-of-service-via-recursive-alias-expansion)
- [Symfony Yaml uncontrolled recursion in parser](https://junglewise.ai/threats/cve-2026-45133-symfony-yaml-uncontrolled-recursion-in-parser)