---
id: "CVE-2026-109413"
kind: "vulnerability"
aliases: ["CVE-2026-109413", "GHSA-2v3c-qxhr-7vpv"]
title: "Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process"
severity: "high"
cvss: 8.7
epss: 0.00395
exploited: false
status: "open"
category: "package"
products: [{"name": "symfony/symfony", "fixed": ["5.4.54"], "affected": ">= 2.0.0, < 5.4.54", "ecosystem": "composer"}, {"name": "symfony/symfony", "fixed": ["6.4.45"], "affected": ">= 6.0.0, < 6.4.45", "ecosystem": "composer"}, {"name": "symfony/symfony", "fixed": ["7.4.18"], "affected": ">= 7.0.0, < 7.4.18", "ecosystem": "composer"}, {"name": "symfony/symfony", "fixed": ["8.1.6"], "affected": ">= 8.0.0, < 8.1.6", "ecosystem": "composer"}, {"name": "symfony/yaml", "fixed": ["5.4.54"], "affected": ">= 2.0.0, < 5.4.54", "ecosystem": "composer"}, {"name": "symfony/yaml", "fixed": ["6.4.45"], "affected": ">= 6.0.0, < 6.4.45", "ecosystem": "composer"}, {"name": "symfony/yaml", "fixed": ["7.4.18"], "affected": ">= 7.0.0, < 7.4.18", "ecosystem": "composer"}, {"name": "symfony/yaml", "fixed": ["8.1.6"], "affected": ">= 8.0.0, < 8.1.6", "ecosystem": "composer"}]
ecosystems: ["composer"]
tags: ["composer", "cwe-674", "package", "php", "symfony", "web-api"]
not_affected_if: ["no-yaml-input", "trusted-yaml-only", "yaml-component-not-installed"]
published_at: "2026-10-15T15:17:24+00:00"
first_seen_at: "2026-10-27T19:04:56+00:00"
updated_at: "2026-10-27T19:33:18+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-2v3c-qxhr-7vpv", "first_seen_at": "2026-10-27T19:04:56+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109413", "first_seen_at": "2026-10-27T19:33:18+00:00"}]
---

# Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process

Symfony's YAML inline lexer recurses without a nesting limit, so a document of deeply nested brackets such as [[[[...]]]] exhausts the stack. An attacker who can submit YAML to the application can crash the process or cause a fatal error with one request.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:symfony/symfony affected >= 2.0.0, < 5.4.54 fixed 5.4.54
- composer:symfony/symfony affected >= 6.0.0, < 6.4.45 fixed 6.4.45
- composer:symfony/symfony affected >= 7.0.0, < 7.4.18 fixed 7.4.18
- composer:symfony/symfony affected >= 8.0.0, < 8.1.6 fixed 8.1.6
- composer:symfony/yaml affected >= 2.0.0, < 5.4.54 fixed 5.4.54
- composer:symfony/yaml affected >= 6.0.0, < 6.4.45 fixed 6.4.45
- composer:symfony/yaml affected >= 7.0.0, < 7.4.18 fixed 7.4.18
- composer:symfony/yaml affected >= 8.0.0, < 8.1.6 fixed 8.1.6

## How to check

- Run `composer show symfony/yaml` and `composer show symfony/symfony` to read the installed versions.
- Search the code for `Yaml::parse`, `Parser` or `#[MapRequestPayload]` on endpoints that accept YAML.

## Fix

- Upgrade `symfony/yaml` and `symfony/symfony` to `5.4.54`, `6.4.45`, `7.4.18` or `8.1.6`, matching the installed major line.

## Timeline

- 2026-10-27T19:04:56+00:00 ghsa https://github.com/advisories/GHSA-2v3c-qxhr-7vpv
- 2026-10-27T19:33:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109413

## From the sources

### Description

`Yaml\Parser::lexInlineStructure()` recursed through `lexInlineMapping()` and `lexInlineSequence()` for every `{` and `[` of an inline collection, without entering the nesting level that the rest of the parser bounds with `maxNestingLevel`. A document made of deeply nested inline collections, such as `[[[[...]]]]`, exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error.

Any code parsing untrusted YAML is affected. That includes `#[MapRequestPayload]` when the Yaml component is installed and the endpoint does not restrict `acceptFormat`: a single unauthenticated request with a YAML content type is enough.

### Resolution

The inline lexer now enters and leaves the same nesting level as the rest of the parser, so nested inline collections are bounded by `maxNestingLevel`, and the parser raises a `ParseException` beyond it.

The patches for this issue are available [here](https://github.com/symfony/symfony/commit/2a8bf9c58d862b0c76a35ce288d1ba6a27223aad) for branch 5.4 (and forward-ported to 6.4, 7.4, 8.1 and 8.2).

### Credits

We would like to thank Nicolas Grekas for reporting the issue and providing the fix.

### References

- Fix: [#65688](https://github.com/symfony/symfony/pull/65688)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_