# CVE-2026-45305: Symfony Yaml ReDoS in Parser cleanup

Source: https://junglewise.ai/threats/cve-2026-45305-symfony-yaml-redos-in-parser-cleanup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-45305 · Severity: medium · CVSS 4 · Published 2026-07-14

A vulnerability in the Symfony PHP framework's YAML parsing component can allow an attacker to crash or slow down a web application. By providing a specially crafted YAML file, an attacker can trigger a process that consumes excessive server resources, leading to a denial-of-service. This affects any application that uses Symfony to process untrusted YAML data, such as configuration uploads or API inputs.

Technologies: [symfony/symfony (Packagist)](https://junglewise.ai/threats/technologies/symfony-symfony), [symfony/yaml (Packagist)](https://junglewise.ai/threats/technologies/symfony-yaml), [Symfony Yaml](https://junglewise.ai/threats/technologies/yaml). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Symfony](https://junglewise.ai/threats/vendors/symfony).

## Quick answers

**Is CVE-2026-45305 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45305 being exploited in the wild.

**How severe is CVE-2026-45305?** Medium severity, with a CVSS score of 4, published 14 July 2026.

**Which products and versions are affected?** symfony/symfony (Packagist) ECOSYSTEM:introduced=0,fixed=5.4.52; symfony/yaml (Packagist) ECOSYSTEM:introduced=0,fixed=5.4.52; Symfony Yaml < 5.4.52, >= 6.0.0-BETA1, < 6.4.40, >= 7.0.0-BETA1, < 7.4.12, >= 8.0.0-BETA1, < 8.0.12, < 5.4.52, >= 6.0.0, < 6.4.40, >= 7.0.0, < 7.4.12, >= 8.0.0, < 8.0.12.

**Is there a fix for CVE-2026-45305?** Yes. symfony/symfony (Packagist): upgrade to 5.4.52 or later; symfony/yaml (Packagist): upgrade to 5.4.52 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45305 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-45305?** Check whether you run symfony/symfony (Packagist), symfony/yaml (Packagist) or Symfony Yaml at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- symfony/symfony (Packagist): upgrade to 5.4.52 or later

  ```sh
  composer require symfony/symfony:^5.4.52
  ```

- symfony/yaml (Packagist): upgrade to 5.4.52 or later

  ```sh
  composer require symfony/yaml:^5.4.52
  ```


## Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in Symfony\Component\Yaml\Parser::cleanup() due to the use of regular expressions with overlapping quantifiers. Specifically, the regexes used for YAML directives, comments, and document markers are susceptible to catastrophic backtracking when processing malicious input. An unauthenticated remote attacker can exploit this by submitting crafted YAML content to an endpoint that parses it, causing the PHP process to hang for an arbitrarily long time and exhausting server resources. The issue is resolved in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12 by hardening the regexes with possessive quantifiers and unambiguous character classes.

## Affected products

- symfony symfony < 5.4.52, >= 6.0.0-BETA1, < 6.4.40, >= 7.0.0-BETA1, < 7.4.12, >= 8.0.0-BETA1, < 8.0.12
- symfony yaml < 5.4.52, >= 6.0.0-BETA1, < 6.4.40, >= 7.0.0-BETA1, < 7.4.12, >= 8.0.0-BETA1, < 8.0.12

## Identifiers

- CVE-2026-45305
- GHSA-9frc-8383-795m

## Timeline

- 2026-07-14: advisory: NVD publication date
- 2026-07-14: disclosed: GitHub advisory published

## References

- [https://github.com/symfony/symfony/commit/9749cd43c5e09b3735093623670b21b9d8a056cb](https://github.com/symfony/symfony/commit/9749cd43c5e09b3735093623670b21b9d8a056cb)
- [https://github.com/symfony/symfony/releases/tag/v5.4.52](https://github.com/symfony/symfony/releases/tag/v5.4.52)
- [https://github.com/symfony/symfony/releases/tag/v6.4.40](https://github.com/symfony/symfony/releases/tag/v6.4.40)
- [https://github.com/symfony/symfony/releases/tag/v7.4.12](https://github.com/symfony/symfony/releases/tag/v7.4.12)
- [https://github.com/symfony/symfony/releases/tag/v8.0.12](https://github.com/symfony/symfony/releases/tag/v8.0.12)
- [https://github.com/symfony/symfony/security/advisories/GHSA-9frc-8383-795m](https://github.com/symfony/symfony/security/advisories/GHSA-9frc-8383-795m)

## Related threats

- [Symfony Yaml component ReDoS in parser and inline](https://junglewise.ai/threats/cve-2026-123792-the-symfony-yaml-components-inline-and-parser-parse-some-yaml)
- [Symfony YAML stack exhaustion in inline lexer](https://junglewise.ai/threats/cve-2026-109413-in-symfony-yaml-prior-to-versions-5-4-54-6-4-45-7-4-18-and-8-1-6)
- [Symfony HTTP Foundation ReDoS in HeaderUtils::split()](https://junglewise.ai/threats/cve-2026-108082-symfony-is-a-php-framework-for-web-and-console-applications-and)
- [Symfony Routing improper dot-segment encoding in UrlGenerator](https://junglewise.ai/threats/cve-2026-48784-symfony-routing-improper-dot-segment-encoding-in-urlgenerator)
- [Symfony HtmlSanitizer XSS via incomplete URL attribute sanitization](https://junglewise.ai/threats/cve-2026-48761-symfony-htmlsanitizer-xss-via-incomplete-url-attribute)