Symfony YAML: Unbounded recursion in inline lexer enables denial of service
Summary
The YAML component of Symfony (symfony/yaml) recurses without a nesting limit when lexing inline collections. A single crafted YAML document with deeply nested brackets such as [[[[...]]]] can exhaust the stack and crash the PHP process or end the request with a fatal error. Any application that parses untrusted YAML is affected, including Symfony endpoints using #[MapRequestPayload] without restricting acceptFormat; one unauthenticated request can be sufficient. The impact is availability only.
Affected
- symfony/yaml before 5.4.54
- symfony/yaml 6.0.0-BETA1 to before 6.4.45
- symfony/yaml 7.0.0-BETA1 to before 7.4.18
- symfony/yaml 8.0.0-BETA1 to before 8.1.6
- Older branches (2.x to 5.4.x) are reported as affected by a third-party source; the vendor range does not state them explicitly.
Fixed in
- 5.4.54
- 6.4.45
- 7.4.18
- 8.1.6
- Debian: 7.4.18+dfsg-1
- Ubuntu: Unknown.
- Unsupported branches: Unknown.
Workaround
- No vendor workaround identified; apply the patched versions.
- If patching is not possible at once, restrict YAML input on endpoints that accept it (for example, set acceptFormat on #[MapRequestPayload] so only JSON is accepted).
- Remove the YAML component from production systems where it is not needed.
Exploitation
- Network-reachable, no authentication or user interaction required according to the advisory.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No public proof of concept or in-the-wild exploitation found at time of research; not verified against CISA KEV.
Our recommendation
- Identify all projects depending on symfony/yaml, including transitive and dev dependencies (for example with composer audit).
- Upgrade to 5.4.54, 6.4.45, 7.4.18 or 8.1.6 or later; plan the 8.0.x upgrade separately and check PHP version requirements.
- Prioritise internet-facing applications and endpoints that accept YAML request bodies.
- Monitor for public proof-of-concept code and CISA KEV listing.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-2v3c-qxhr-7vpv github.com
- Symfony blog: CVE-2026-109413 symfony.com
- Symfony fix pull request #65688 github.com
- symfony/yaml release v7.4.18 github.com
- Debian OSV entry DEBIAN-CVE-2026-109413 osv.dev
- Ubuntu security CVE-2026-109413 ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:30.
Original description (NVD)
In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A document made of deeply nested inline collections, such as [[[[...]]]], exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error. Any code parsing untrusted YAML is affected. That includes #[MapRequestPayload] when the Yaml component is installed and the endpoint does not restrict acceptFormat: a single unauthenticated request with a YAML content type is enough. This issue affects symfony/yaml through v5.4.53, v6.0.0-BETA1 through v6.4.44, v7.0.0-BETA1 through v7.4.17, and v8.0.0-BETA1 through v8.1.5.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.