CVE-2026-45133: Symfony Yaml uncontrolled recursion in parser

CVE-2026-45133 · Severity: medium · CVSS 4 · Published 2026-07-14

Symfony, a popular framework for building PHP web applications, contains a vulnerability in its YAML parsing component. An attacker can send a specially crafted document with deeply nested data structures to crash the web server. This results in a denial-of-service, making the application unavailable to legitimate users.

Technologies: symfony/symfony (Packagist), symfony/yaml (Packagist), Symfony Yaml. Vendors: Packagist, Symfony.

Quick answers

Is CVE-2026-45133 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45133 being exploited in the wild.
How severe is CVE-2026-45133?
Medium severity, with a CVSS score of 4, published 14 July 2026.
Which products and versions are affected?
symfony/symfony (Packagist) ECOSYSTEM:introduced=0,fixed=5.4.52; symfony/yaml (Packagist) ECOSYSTEM:introduced=0,fixed=5.4.52; Symfony Yaml < 5.4.52, >= 6.0.0 < 6.4.40, >= 7.0.0 < 7.4.12, >= 8.0.0 < 8.0.12.
Is there a fix for CVE-2026-45133?
Yes. symfony/symfony (Packagist): upgrade to 5.4.52 or later; symfony/yaml (Packagist): upgrade to 5.4.52 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45133 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-45133?
Check whether you run symfony/symfony (Packagist), symfony/yaml (Packagist) or Symfony Yaml at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • symfony/symfony (Packagist): upgrade to 5.4.52 or later
    composer require symfony/symfony:^5.4.52
  • symfony/yaml (Packagist): upgrade to 5.4.52 or later
    composer require symfony/yaml:^5.4.52

Technical details

The vulnerability is classified as uncontrolled recursion (CWE-674) within Symfony's Yaml component. Specifically, both the block-level parser (Parser::parseBlock()) and inline parsers (Inline::parseSequence() and Inline::parseMapping()) fail to enforce a depth limit when processing nested structures. If an application exposes these parsers to attacker-controlled input, a remote, unauthenticated attacker can provide a crafted YAML document that triggers infinite or excessive recursion. This leads to PHP stack exhaustion and a crash of the worker process, resulting in a denial-of-service (DoS). The issue is resolved by bounding the recursion depth in the affected versions.

Affected products

  • Symfony Symfony < 5.4.52, >= 6.0.0-BETA1 < 6.4.40, >= 7.0.0-BETA1 < 7.4.12, >= 8.0.0-BETA1 < 8.0.12

Identifiers

  • CVE-2026-45133
  • GHSA-c2p3-7m5p-cv8x

Timeline

  • 2026-05-20: patched: Security releases 5.4.52, 6.4.40, 7.4.12, and 8.0.12 published.
  • 2026-07-14: disclosed: CVE-2026-45133 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.