Junglewise Threat Intelligence

CVE-2026-45304: Symfony Yaml denial of service via recursive alias expansion

CVE-2026-45304 · Severity: medium · CVSS 4 · Published 2026-07-14

Technologies: Symfony Yaml. Vendors: Symfony.

Executive brief

A vulnerability in the Symfony PHP framework's YAML processing component could allow an attacker to crash a web application. By submitting a specially crafted, small YAML file, an attacker can force the server to consume massive amounts of memory, leading to a denial-of-service (DoS) condition. This affects any application that parses untrusted YAML input using the vulnerable versions of the library.

Technical details

The Symfony\Component\Yaml\Parser component fails to properly restrict the number of recursive collection aliases during YAML parsing. An attacker can provide a small, crafted YAML document containing recursive aliases that expand exponentially into a multi-gigabyte structure upon resolution. This leads to memory exhaustion and a denial-of-service (DoS) condition. The vulnerability is classified as CWE-776 (Improper Restriction of Recursive Entity References). The fix introduces a default limit of 128 resolved collection aliases and adds a new flag, Yaml::PARSE_EXCEPTION_ON_ALIAS, to allow developers to reject aliases entirely when handling untrusted input. Patches are available in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Affected products

  • Symfony symfony/symfony < 5.4.52, >= 6.0.0-BETA1, < 6.4.40, >= 7.0.0-BETA1, < 7.4.12, >= 8.0.0-BETA1, < 8.0.12
  • Symfony symfony/yaml < 5.4.52, >= 6.0.0-BETA1, < 6.4.40, >= 7.0.0-BETA1, < 7.4.12, >= 8.0.0-BETA1, < 8.0.12

Timeline

  • 2026-05-08: other: Initial fix authored
  • 2026-05-20: patched: Security releases published
  • 2026-07-14: advisory: NVD advisory published

References

Related threats