CVE-2026-45304 Details
Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser resolved YAML collection aliases recursively, allowing a small untrusted YAML input to expand into a multi-gigabyte structure and exhaust memory. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
A denial-of-service vulnerability has been identified in the Symfony YAML component, specifically in versions prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12. The issue arises in the 'Symfony\Component\Yaml\Parser' class, where YAML collection aliases are resolved recursively. This recursive resolution allows a small, untrusted YAML input to expand into a multi-gigabyte structure, exhausting memory resources. The vulnerability is akin to the 'Billion Laughs' attack, targeting any parser that processes untrusted YAML.
Users can upgrade to Symfony versions 5.4.52, 6.4.40, 7.4.12, or 8.0.12, where this vulnerability has been fixed. The parser has been modified to limit the number of resolved collection aliases to prevent such recursive exploitation.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/symfony/symfony/commit/e77391b2e4f18821198f010d573674c8ed4a970a | [email protected] | Patch |
| https://github.com/symfony/symfony/releases/tag/v5.4.52 | [email protected] | ProductRelease Notes |
| https://github.com/symfony/symfony/releases/tag/v6.4.40 | [email protected] | ProductRelease Notes |
| https://github.com/symfony/symfony/releases/tag/v7.4.12 | [email protected] | ProductRelease Notes |
| https://github.com/symfony/symfony/releases/tag/v8.0.12 | [email protected] | ProductRelease Notes |
| https://github.com/symfony/symfony/security/advisories/GHSA-4qpc-3hr4-r2p4 | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-776 | Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sensiolabs symfony | < 5.4.52 >= 6.0.0, < 6.4.40 >= 7.0.0, < 7.4.12 >= 8.0.0, < 8.0.12 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | Initial Analysis | [email protected] |
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | New CVE Received | [email protected] |