{"id":"CVE-2026-109413","kind":"vulnerability","aliases":["CVE-2026-109413","GHSA-2v3c-qxhr-7vpv"],"related":[],"title":"Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process","description":"### Description\n\n`Yaml\\Parser::lexInlineStructure()` recursed through `lexInlineMapping()` and `lexInlineSequence()` for every `{` and `[` of an inline collection, without entering the nesting level that the rest of the parser bounds with `maxNestingLevel`. A document made of deeply nested inline collections, such as `[[[[...]]]]`, exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error.\n\nAny code parsing untrusted YAML is affected. That includes `#[MapRequestPayload]` when the Yaml component is installed and the endpoint does not restrict `acceptFormat`: a single unauthenticated request with a YAML content type is enough.\n\n### Resolution\n\nThe inline lexer now enters and leaves the same nesting level as the rest of the parser, so nested inline collections are bounded by `maxNestingLevel`, and the parser raises a `ParseException` beyond it.\n\nThe patches for this issue are available [here](https://github.com/symfony/symfony/commit/2a8bf9c58d862b0c76a35ce288d1ba6a27223aad) for branch 5.4 (and forward-ported to 6.4, 7.4, 8.1 and 8.2).\n\n### Credits\n\nWe would like to thank Nicolas Grekas for reporting the issue and providing the fix.\n\n### References\n\n- Fix: [#65688](https://github.com/symfony/symfony/pull/65688)","summary":"Symfony's YAML inline lexer recurses without a nesting limit, so a document of deeply nested brackets such as [[[[...]]]] exhausts the stack. An attacker who can submit YAML to the application can crash the process or cause a fatal error with one request.","severity":"high","cvss":8.7,"epss":0.00395,"exploited":false,"exploited_at":null,"products":[{"name":"symfony/symfony","fixed":["5.4.54"],"affected":">= 2.0.0, < 5.4.54","ecosystem":"composer"},{"name":"symfony/symfony","fixed":["6.4.45"],"affected":">= 6.0.0, < 6.4.45","ecosystem":"composer"},{"name":"symfony/symfony","fixed":["7.4.18"],"affected":">= 7.0.0, < 7.4.18","ecosystem":"composer"},{"name":"symfony/symfony","fixed":["8.1.6"],"affected":">= 8.0.0, < 8.1.6","ecosystem":"composer"},{"name":"symfony/yaml","fixed":["5.4.54"],"affected":">= 2.0.0, < 5.4.54","ecosystem":"composer"},{"name":"symfony/yaml","fixed":["6.4.45"],"affected":">= 6.0.0, < 6.4.45","ecosystem":"composer"},{"name":"symfony/yaml","fixed":["7.4.18"],"affected":">= 7.0.0, < 7.4.18","ecosystem":"composer"},{"name":"symfony/yaml","fixed":["8.1.6"],"affected":">= 8.0.0, < 8.1.6","ecosystem":"composer"}],"ecosystems":["composer"],"tags":["composer","cwe-674","package","php","symfony","web-api"],"not_affected_if":["no-yaml-input","trusted-yaml-only","yaml-component-not-installed"],"how_to_check":"- Run `composer show symfony/yaml` and `composer show symfony/symfony` to read the installed versions.\n- Search the code for `Yaml::parse`, `Parser` or `#[MapRequestPayload]` on endpoints that accept YAML.","fix":"- Upgrade `symfony/yaml` and `symfony/symfony` to `5.4.54`, `6.4.45`, `7.4.18` or `8.1.6`, matching the installed major line.","status":"open","published_at":"2026-10-15T15:17:24+00:00","first_seen_at":"2026-10-27T19:04:56+00:00","triaged_at":"2026-10-27T19:05:56+00:00","updated_at":"2026-10-27T19:33:18+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-27T19:05:56Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `symfony/yaml` and `symfony/symfony` to `5.4.54`, `6.4.45`, `7.4.18` or `8.1.6`, matching the installed major line.","reach":"internet","title":"Symfony YAML parser: deeply nested inline collections crash the PHP process","impact":"medium","summary":"Symfony's YAML inline lexer recurses without a nesting limit, so a document of deeply nested brackets such as [[[[...]]]] exhausts the stack. An attacker who can submit YAML to the application can crash the process or cause a fatal error with one request.","category":"package","nicknames":[],"who_cares":["symfony","php","composer","web-api"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated request crashes the PHP process or ends in a fatal error","analyst_note":"","how_to_check":"- Run `composer show symfony/yaml` and `composer show symfony/symfony` to read the installed versions.\n- Search the code for `Yaml::parse`, `Parser` or `#[MapRequestPayload]` on endpoints that accept YAML.","needs_analyst":false,"not_affected_if":["no-yaml-input","trusted-yaml-only","yaml-component-not-installed"],"who_is_affected":"Applications that parse untrusted YAML with the Symfony Yaml component installed, including endpoints using #[MapRequestPayload] that do not restrict acceptFormat. Applications that parse only trusted, internal YAML files are less exposed, and applications that do not install the Yaml component are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000697,"input_tokens":4053,"output_tokens":583,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-109413':18A,26A '-2026':17A,25A '-674':37B '/symfony/symfony/commit/2a8bf9c58d862b0c76a35ce288d1ba6a27223aad)':233C '/symfony/symfony/pull/65688)':268C '2v3c':21A '5.4':236C '6.4':242C '65688':265C '7.4':243C '7vpv':23A '8.1':244C '8.2':246C 'acceptformat':177C 'affect':161C 'api':43B 'applic':74B 'attack':67B 'avail':229C 'beyond':221C 'bound':114C,212C 'bracket':60B 'branch':235C 'caus':80B 'code':156C 'collect':102C,124C,210C 'compon':168C 'compos':35B 'content':185C 'crash':13A,76B,146C 'credit':247C 'cve':16A,24A 'cwe':36B 'deepli':58B,121C 'depend':135C 'descript':87C 'document':12A,56B,118C 'end':150C 'endpoint':173C 'enough':188C 'enter':104C,194C 'error':83B,154C 'everi':97C 'exhaust':63B,127C 'fatal':82B,153C 'fix':262C,264C 'forward':239C 'forward-port':238C 'ghsa':20A 'ghsa-2v3c-qxhr-7vpv':19A 'github.com':232C,267C 'github.com/symfony/symfony/commit/2a8bf9c58d862b0c76a35ce288d1ba6a27223aad)':231C 'github.com/symfony/symfony/pull/65688)':266C 'greka':254C 'includ':163C 'inlin':7A,47B,101C,123C,191C,209C 'instal':170C 'issu':227C,258C 'leav':196C 'let':9A 'level':107C,200C 'lex':134C 'lexer':8A,48B,192C 'lexinlinemap':93C 'lexinlinesequ':95C 'lexinlinestructur':90C 'like':250C 'limit':53B 'made':119C 'maprequestpayload':164C 'maxnestinglevel':116C,214C 'nest':52B,59B,106C,122C,199C,208C 'nicola':253C 'one':85B 'packag':38B 'pars':157C 'parseexcept':220C 'parser':89C,113C,206C,217C 'patch':224C 'php':39B,138C 'port':240C 'process':15A,78B,145C 'provid':260C 'qxhr':22A 'rais':218C 'recurs':3A,49B,91C 'refer':263C 'report':256C 'request':86B,149C,181C 'resolut':189C 'rest':110C,203C 'restrict':176C 'set':143C 'singl':11A,179C 'stack':65B,129C,142C 'submit':70B 'symfoni':1A,40B,44B 'symfony/symfony':27A,28A,29A,30A 'symfony/yaml':31A,32A,33A,34A 'thank':252C 'type':186C 'unauthent':180C 'unbound':2A 'untrust':158C 'version':139C 'web':42B 'web-api':41B 'without':50B,103C 'would':249C 'yaml':6A,46B,71B,88C,159C,167C,184C","nicknames":[],"mitigations":[],"who_affected":"Applications that parse untrusted YAML with the Symfony Yaml component installed, including endpoints using #[MapRequestPayload] that do not restrict acceptFormat. Applications that parse only trusted, internal YAML files are less exposed, and applications that do not install the Yaml component are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-15T15:17:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"596c5446-0ce5-4ba2-aa66-48b3b757a647","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-2v3c-qxhr-7vpv","url":"https://github.com/advisories/GHSA-2v3c-qxhr-7vpv","severity":"high","published_at":"2026-10-27T19:01:50+00:00","modified_at":"2026-10-27T19:01:52+00:00","first_seen_at":"2026-10-27T19:04:56+00:00","fetched_at":"2026-10-27T19:04:56+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-109413","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109413","severity":null,"published_at":"2026-10-15T15:17:24+00:00","modified_at":"2026-10-16T16:00:33+00:00","first_seen_at":"2026-10-27T19:33:18+00:00","fetched_at":"2026-10-27T19:33:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}