Executive brief
Symfony, a popular framework for building PHP web applications, contains a vulnerability in its YAML parsing component. An attacker can send a specially crafted document with deeply nested data structures to crash the web server. This results in a denial-of-service, making the application unavailable to legitimate users.
Technical details
The vulnerability is classified as uncontrolled recursion (CWE-674) within Symfony's Yaml component. Specifically, both the block-level parser (Parser::parseBlock()) and inline parsers (Inline::parseSequence() and Inline::parseMapping()) fail to enforce a depth limit when processing nested structures. If an application exposes these parsers to attacker-controlled input, a remote, unauthenticated attacker can provide a crafted YAML document that triggers infinite or excessive recursion. This leads to PHP stack exhaustion and a crash of the worker process, resulting in a denial-of-service (DoS). The issue is resolved by bounding the recursion depth in the affected versions.
Affected products
- Symfony Symfony < 5.4.52, >= 6.0.0-BETA1 < 6.4.40, >= 7.0.0-BETA1 < 7.4.12, >= 8.0.0-BETA1 < 8.0.12
Timeline
- 2026-05-20: patched: Security releases 5.4.52, 6.4.40, 7.4.12, and 8.0.12 published.
- 2026-07-14: disclosed: CVE-2026-45133 published.