---
id: "GHSA-cpww-5vpx-72x7"
page: "https://infrastack.ai/live/GHSA-cpww-5vpx-72x7"
kind: "vulnerability"
aliases: ["GHSA-cpww-5vpx-72x7"]
title: "Incomplete Fix for CVE-2026-45756: JsonPath Queries Can Still Hold a Process Through search(), match() and Chained Filters"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "symfony/json-path", "note": ">=7.3.0, <7.4.23", "fixed": ["7.4.23"], "affected": ">= 7.3.0, < 7.4.23", "ecosystem": "composer"}, {"name": "symfony/json-path", "note": ">=8.0.0, <8.1.11", "fixed": ["8.1.11"], "affected": ">= 8.0.0, < 8.1.11", "ecosystem": "composer"}, {"name": "symfony/symfony", "note": ">=7.3.0, <7.4.23", "fixed": ["7.4.23"], "affected": ">= 7.3.0, < 7.4.23", "ecosystem": "composer"}, {"name": "symfony/symfony", "note": ">=8.0.0, <8.1.11", "fixed": ["8.1.11"], "affected": ">= 8.0.0, < 8.1.11", "ecosystem": "composer"}]
ecosystems: ["composer"]
tags: ["cwe-1333", "cwe-400", "cwe-407", "json-path", "package", "php", "self-hosted", "symfony"]
not_affected_if: ["auth-required", "static-queries", "trusted-input"]
published_at: "2026-11-04T11:43:33+00:00"
first_seen_at: "2026-11-09T22:53:32+00:00"
updated_at: "2026-11-09T22:58:42+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/symfony/symfony/security/advisories/GHSA-cpww-5vpx-72x7", "first_seen_at": "2026-11-09T22:53:32+00:00"}]
exploit_sources: []
---

# Incomplete Fix for CVE-2026-45756: JsonPath Queries Can Still Hold a Process Through search(), match() and Chained Filters

Link for people: https://infrastack.ai/live/GHSA-cpww-5vpx-72x7 (this .md is for agents)

The JsonPath component in Symfony still lets a crafted query with search(), match() or chained filters burn CPU far beyond its size, after an earlier fix for the same class of flaw. An application that evaluates an attacker-influenced JSONPath expression can have a PHP worker held for minutes, a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:symfony/json-path affected >= 7.3.0, < 7.4.23 fixed 7.4.23
- composer:symfony/json-path affected >= 8.0.0, < 8.1.11 fixed 8.1.11
- composer:symfony/symfony affected >= 7.3.0, < 7.4.23 fixed 7.4.23
- composer:symfony/symfony affected >= 8.0.0, < 8.1.11 fixed 8.1.11

## How to check

- Run `composer show symfony/json-path` and `composer show symfony/symfony` to read the installed versions.
- Look for code that passes user-supplied strings to JsonPath or JsonCrawler `find()` with filter expressions.

## Fix

- `symfony/json-path` 7.x: `7.4.23`
- `symfony/json-path` 8.x: `8.1.11`
- `symfony/symfony` 7.x: `7.4.23`
- `symfony/symfony` 8.x: `8.1.11`

## Timeline

- 2026-11-09T22:53:32+00:00 ghsa-repo https://github.com/symfony/symfony/security/advisories/GHSA-cpww-5vpx-72x7

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/symfony/symfony/security/advisories/GHSA-cpww-5vpx-72x7

## From the sources

### Description

The fix for CVE-2026-45756 lowers `pcre.backtrack_limit` to 10000 around each `preg_match()` call of the `match()` and `search()` filter functions. That limit applies to one starting position, not to one call. PCRE resets its counter at every position it tries a match from. So an unanchored pattern that stays just under the limit is paid once per byte of the subject. Each call also starts from a fresh limit, so chaining clauses in one filter multiplies the work.

Two other paths made the cost of a query grow faster than its size, without any regular expression:

- The filter evaluator scanned the whole expression for logical operators once per node. Its cost grew with the square of the number of chained clauses.
- Queries starting with `$` inside a filter, like `@.x == $.limit` or `length($.items)`, were evaluated again for every node the filter visits.

An application that evaluates an attacker-influenced JSONPath expression can therefore still be made to hold a PHP worker. A document of 2 MB and a query of 2.5 KB take 3.5 minutes of CPU.

### Resolution

`JsonCrawler::find()` now bounds the total regex work of one call, and throws an exception when that budget is exhausted. Filter expressions are parsed once per query, and absolute queries inside filters are evaluated once per query.

The patches for this issue are available [here](https://github.com/symfony/symfony/commit/11650dc31f03badb5d24199a1023539ae6380ff2), [here](https://github.com/symfony/symfony/commit/df0d7dc6b1fd7a671be3a6519a82047bb2ab6b47) and [here](https://github.com/symfony/symfony/commit/45e44c5e228c131185e334c7ba390d51ea4517f8) for branch 7.4 (and forward-ported to 8.1 and 8.2).

### Credits

We would like to thank Kamil Vavra for reporting the issue and Nicolas Grekas for finding the related ones and providing the fix.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_