Symfony Expression Language: Denial of service via unbounded expression nesting
Summary
The parser of the Symfony ExpressionLanguage component builds expression trees without a depth limit. A crafted expression with tens of thousands of nested operators, array literals or property accesses crashes the PHP process while the tree is freed. The Symfony validator constraint Assert\ExpressionSyntax passes user-supplied values to this parser, so an application that lets users submit expressions can be crashed with a single request.
Affected
- symfony/expression-language up to 5.4.53
- symfony/expression-language 6.0.0-BETA1 to 6.4.47
- symfony/expression-language 7.0.0-BETA1 to 7.4.20
- symfony/expression-language 8.0.0-BETA1 to 8.1.8
Fixed in
- 5.4.54
- 6.4.48
- 7.4.21
- 8.1.9
Workaround
- No vendor workaround known.
- Until patched, restrict who can submit expressions and limit their length at the input layer.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No known exploitation in the wild found in the sources reviewed; CISA KEV not checked.
- No public proof of concept found.
Our recommendation
- Update symfony/expression-language to the fixed versions listed above, for example with composer update symfony/expression-language.
- Run composer audit on all Symfony projects to find affected installations.
- Prioritise applications where users can write or submit expressions, such as user-defined rules or validation.
- Monitor application processes for unexpected crashes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Symfony security advisory GHSA-7rpj-w9pf-39rr github.com
- Symfony blog: CVE-2026-109449 unbounded nesting in the expression parser symfony.com
- OSV: CVE-2026-109449 osv.dev
- Symfony PR 65690: Bound the nesting level of parsed expressions github.com
- Symfony PR 66720: Fix nesting level of chained ternaries github.com
- Symfony PR 66723: Bound the depth of the parsed node tree github.com
- Ubuntu security: CVE-2026-109449 ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:28.
Original description (NVD)
In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed. #[Assert\ExpressionSyntax] passes the validated value to ExpressionLanguage::lint(), so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions. This issue affects symfony/expression-language through v5.4.53, v6.0.0-BETA1 through v6.4.47, v7.0.0-BETA1 through v7.4.20, and v8.0.0-BETA1 through v8.1.8.
NVD references (5)
- https://github.com/symfony/symfony/pull/65690
- https://github.com/symfony/symfony/pull/66720
- https://github.com/symfony/symfony/pull/66723
- https://github.com/symfony/symfony/security/advisories/GHSA-7rpj-w9pf-39rr
- https://symfony.com/blog/cve-2026-109449-unbounded-nesting-in-the-expression-parser-lets-untrusted-expression…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.