CVE-2026-49209: Symfony UX LiveComponent denial of service in BatchActionController

CVE-2026-49209 · Severity: medium · CVSS 4 · Published 2026-07-17

Symfony UX LiveComponent is a library used to build interactive user interfaces in Symfony web applications. A vulnerability allows an authenticated user to send a single request containing an unlimited number of actions, which the server attempts to process all at once. This can lead to a denial-of-service (DoS) condition by exhausting the server's CPU, memory, and database connections, potentially making the application unavailable to other users.

Technologies: symfony/ux-live-component (Packagist). Vendors: Packagist, Symfony.

Quick answers

Is CVE-2026-49209 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49209 being exploited in the wild.
How severe is CVE-2026-49209?
Medium severity, with a CVSS score of 4, published 17 July 2026.
Which products and versions are affected?
symfony/ux-live-component (Packagist) ECOSYSTEM:introduced=2.5.0,fixed=2.36.0; Symfony UX LiveComponent >= 2.5.0, < 2.36.0; >= 3.0.0, < 3.1.0.
Is there a fix for CVE-2026-49209?
Yes. symfony/ux-live-component (Packagist): upgrade to 2.36.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49209 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-49209?
Check whether you run symfony/ux-live-component (Packagist) or Symfony UX LiveComponent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • symfony/ux-live-component (Packagist): upgrade to 2.36.0 or later
    composer require symfony/ux-live-component:^2.36.0

Technical details

The vulnerability exists in the BatchActionController::__invoke() method of Symfony UX LiveComponent. The controller iterates over a client-supplied array of actions and issues a full HttpKernel sub-request for every entry without enforcing an upper bound on the array size. An authenticated attacker can submit a single '_batch' request containing thousands of actions, triggering intensive operations including validation, database queries, and rendering for each action. This leads to resource exhaustion (CPU, memory, and database connections). The issue is resolved in versions 2.36.0 and 3.1.0 by capping the number of actions per batch request to 50.

Affected products

  • Symfony UX LiveComponent >= 2.5.0, < 2.36.0; >= 3.0.0, < 3.1.0

Identifiers

  • CVE-2026-49209
  • GHSA-mm82-c99c-h2cf

Timeline

  • 2026-07-17: advisory: NVD and GitHub advisory published
  • 2026-05-24: patched: Fix committed to repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.