CVE-2026-45133
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
A vulnerability in Symfony allows a DoS attack via deeply nested YAML structures. The lack of recursion depth limit in the parser causes PHP stack exhaustion and worker crash.
Risk Assessment
An attacker can remotely crash the application by sending a crafted YAML document, resulting in denial of service (DoS).
Recommendation
Immediately upgrade Symfony to version 5.4.52, 6.4.40, 7.4.12, or 8.0.12 depending on the branch used.
Other vulnerabilities in Symfony
See all- CVE-2016-4423High
The attemptAuthentication function in Symfony before versions 2.3.41, 2.7.13, 2.8.6, and 3.0.6 does not limit the length of a username stored in a session. This allows remote attackers to cause a denial of service through a series of authentication attempts with long, non-existent usernames.
- CVE-2016-1902High
The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library, and the openssl_random_pseudo_bytes function fails.
- CVE-2013-1397High
Symfony versions 2.0.x before 2.0.22, 2.1.x before 2.1.7, and 2.2.x are vulnerable to remote attacks that allow arbitrary PHP code execution via a serialized PHP object in the Yaml::parse or Yaml\Parser::parse functions.
- CVE-2013-1348High
The Yaml::parse function in Symfony 2.0.x before version 2.0.22 allows remote attackers to execute arbitrary PHP code via a PHP file, which is a different vulnerability than CVE-2013-1397.
- CVE-2026-47767Critical
A vulnerability in Symfony allows an attacker to manipulate the APP_ENV and APP_DEBUG environment variables via a crafted query string that bypasses the protection introduced in CVE-2024-50340. The issue stems from a discrepancy between parse_str() and the web SAPI, enabling attacker-controlled --env or --no-debug flags to be passed to the script.
- CVE-2026-45069Critical
In Symfony up to versions 6.4.40, 7.4.12, and 8.0.12, the OidcTokenHandler::verifyClaims() method registered audience (aud), issuer (iss), and expiry (exp) checkers but did not pass the mandatory claims list to ClaimCheckerManager::check(). This allowed a validly signed JWT missing those claims to pass verification.
- CVE-2026-45063Critical
A vulnerability in Symfony X509Authenticator allows an attacker with a trusted certificate to impersonate a victim by placing emailAddress= in another RDN value, such as CN, due to an unanchored regex.
- CVE-2016-2403Critical
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
- CVE-2026-48784Medium
A vulnerability in Symfony allows an attacker to manipulate URL paths via controlled route parameters. The UrlGenerator::doGenerate() function uses strtr() dot-segment encoding that skips every other chained ../ or ./ segment, enabling generation of URLs that collapse to a different path under RFC 3986 normalization.
- CVE-2026-48761Medium
In Symfony PHP framework from 6.1.0 to 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSanitizer::getSupportedAttributes() omitted URL-bearing attributes on <object>, <applet>, <iframe>, and <img>, and <meta http-equiv="refresh"> URLs bypassed sanitization, allowing javascript: payloads. Fixed in versions 6.4.41, 7.4.13, and 8.0.13.
Original NVD description (English source)
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, when the parser is exposed to attacker-controlled input, deeply nested mappings or sequences cause both the block-level (Parser::parseBlock()) and inline (Inline::parseSequence() / Inline::parseMapping()) parsers to recurse without a depth limit. A crafted document exhausts the PHP stack and crashes the worker. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.