Executive brief
A vulnerability in the Symfony PHP framework's JsonPath component allows attackers to cause a denial of service. By providing a specially crafted search pattern, an attacker can force the server's processor to work excessively hard, potentially crashing the application or making it unresponsive to legitimate users. This affects applications that process user-provided JSONPath expressions.
Technical details
The Symfony JsonPath component's match() and search() filter functions compile caller-supplied patterns directly into preg_match() without sufficient validation. Specifically, the transformJsonPathRegex() function lacks length caps, i-regexp restrictions, or backtracking bounds. An attacker can provide a JSONPath expression containing a catastrophic-backtracking pattern (e.g., $[?search(@, "(a+)+
quot;)]) which, when evaluated against non-trivial JSON input, pins the CPU and exhausts the worker pool. Because the calls use the '@' error suppressor, PCRE backtrack-limit errors are hidden from logs. The fix involves capping pcre.backtrack_limit to 10,000 during these operations.Affected products
- symfony symfony/json-path >= 7.3.0-BETA1, < 7.4.12
- symfony symfony/json-path >= 8.0.0-BETA1, < 8.0.12
- symfony symfony/symfony >= 7.3.0-BETA1, < 7.4.12
- symfony symfony/symfony >= 8.0.0-BETA1, < 8.0.12
Timeline
- 2026-05-20: advisory: GitHub Security Advisory GHSA-8v8v-g73j-492j published
- 2026-05-20: patched: Fixed in versions 7.4.12 and 8.0.12
- 2026-07-14: disclosed: CVE-2026-45756 published to NVD