CVE-2026-45305: Symfony Yaml ReDoS in Parser cleanup

CVE-2026-45305 · Severity: medium · CVSS 4 · Published 2026-07-14

A vulnerability in the Symfony PHP framework's YAML parsing component can allow an attacker to crash or slow down a web application. By providing a specially crafted YAML file, an attacker can trigger a process that consumes excessive server resources, leading to a denial-of-service. This affects any application that uses Symfony to process untrusted YAML data, such as configuration uploads or API inputs.

Technologies: symfony/symfony (Packagist), symfony/yaml (Packagist), Symfony Yaml. Vendors: Packagist, Symfony.

Quick answers

Is CVE-2026-45305 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45305 being exploited in the wild.
How severe is CVE-2026-45305?
Medium severity, with a CVSS score of 4, published 14 July 2026.
Which products and versions are affected?
symfony/symfony (Packagist) ECOSYSTEM:introduced=0,fixed=5.4.52; symfony/yaml (Packagist) ECOSYSTEM:introduced=0,fixed=5.4.52; Symfony Yaml < 5.4.52, >= 6.0.0-BETA1, < 6.4.40, >= 7.0.0-BETA1, < 7.4.12, >= 8.0.0-BETA1, < 8.0.12, < 5.4.52, >= 6.0.0, < 6.4.40, >= 7.0.0, < 7.4.12, >= 8.0.0, < 8.0.12.
Is there a fix for CVE-2026-45305?
Yes. symfony/symfony (Packagist): upgrade to 5.4.52 or later; symfony/yaml (Packagist): upgrade to 5.4.52 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45305 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-45305?
Check whether you run symfony/symfony (Packagist), symfony/yaml (Packagist) or Symfony Yaml at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • symfony/symfony (Packagist): upgrade to 5.4.52 or later
    composer require symfony/symfony:^5.4.52
  • symfony/yaml (Packagist): upgrade to 5.4.52 or later
    composer require symfony/yaml:^5.4.52

Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in Symfony\Component\Yaml\Parser::cleanup() due to the use of regular expressions with overlapping quantifiers. Specifically, the regexes used for YAML directives, comments, and document markers are susceptible to catastrophic backtracking when processing malicious input. An unauthenticated remote attacker can exploit this by submitting crafted YAML content to an endpoint that parses it, causing the PHP process to hang for an arbitrarily long time and exhausting server resources. The issue is resolved in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12 by hardening the regexes with possessive quantifiers and unambiguous character classes.

Affected products

  • symfony symfony < 5.4.52, >= 6.0.0-BETA1, < 6.4.40, >= 7.0.0-BETA1, < 7.4.12, >= 8.0.0-BETA1, < 8.0.12
  • symfony yaml < 5.4.52, >= 6.0.0-BETA1, < 6.4.40, >= 7.0.0-BETA1, < 7.4.12, >= 8.0.0-BETA1, < 8.0.12

Identifiers

  • CVE-2026-45305
  • GHSA-9frc-8383-795m

Timeline

  • 2026-07-14: advisory: NVD publication date
  • 2026-07-14: disclosed: GitHub advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.