Executive brief
Symfony UX LiveComponent is a library used to build interactive user interfaces in Symfony web applications. A vulnerability allows an authenticated user to send a single request containing an unlimited number of actions, which the server attempts to process all at once. This can lead to a denial-of-service (DoS) condition by exhausting the server's CPU, memory, and database connections, potentially making the application unavailable to other users.
Technical details
The vulnerability exists in the BatchActionController::__invoke() method of Symfony UX LiveComponent. The controller iterates over a client-supplied array of actions and issues a full HttpKernel sub-request for every entry without enforcing an upper bound on the array size. An authenticated attacker can submit a single '_batch' request containing thousands of actions, triggering intensive operations including validation, database queries, and rendering for each action. This leads to resource exhaustion (CPU, memory, and database connections). The issue is resolved in versions 2.36.0 and 3.1.0 by capping the number of actions per batch request to 50.
Affected products
- Symfony UX LiveComponent >= 2.5.0, < 2.36.0; >= 3.0.0, < 3.1.0
Timeline
- 2026-07-17: advisory: NVD and GitHub advisory published
- 2026-05-24: patched: Fix committed to repository