Live › vulnerability › CVE-2026-109413
Go to dashboardSymfony's YAML inline lexer recurses without a nesting limit, so a document of deeply nested brackets such as [[[[...]]]] exhausts the stack. An attacker who can submit YAML to the application can crash the process or cause a fatal error with one request.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 19:04 UTC, 0h before NVD. All times on this page are UTC.
Applications that parse untrusted YAML with the Symfony Yaml component installed, including endpoints using #[MapRequestPayload] that do not restrict acceptFormat. Applications that parse only trusted, internal YAML files are less exposed, and applications that do not install the Yaml component are not affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| symfony/symfony | composer | >= 2.0.0, < 5.4.54 | 5.4.54 |
| symfony/symfony | composer | >= 6.0.0, < 6.4.45 | 6.4.45 |
| symfony/symfony | composer | >= 7.0.0, < 7.4.18 | 7.4.18 |
| symfony/symfony | composer | >= 8.0.0, < 8.1.6 | 8.1.6 |
| symfony/yaml | composer | >= 2.0.0, < 5.4.54 | 5.4.54 |
| symfony/yaml | composer | >= 6.0.0, < 6.4.45 | 6.4.45 |
| symfony/yaml | composer | >= 7.0.0, < 7.4.18 | 7.4.18 |
| symfony/yaml | composer | >= 8.0.0, < 8.1.6 | 8.1.6 |
composer show symfony/yaml and composer show symfony/symfony to read the installed versions.Yaml::parse, Parser or #[MapRequestPayload] on endpoints that accept YAML.symfony/yaml and symfony/symfony to 5.4.54, 6.4.45, 7.4.18 or 8.1.6, matching the installed major line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A document made of deeply nested inline collections, such as [[[[...]]]], exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error.
Any code parsing untrusted YAML is affected. That includes #[MapRequestPayload] when the Yaml component is installed and the endpoint does not restrict acceptFormat: a single unauthenticated request with a YAML content type is enough.
The inline lexer now enters and leaves the same nesting level as the rest of the parser, so nested inline collections are bounded by maxNestingLevel, and the parser raises a ParseException beyond it.
The patches for this issue are available here for branch 5.4 (and forward-ported to 6.4, 7.4, 8.1 and 8.2).
We would like to thank Nicolas Grekas for reporting the issue and providing the fix.
This page as .md · .json · in your agent: get_signal("CVE-2026-109413")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.