Symfony ExpressionLanguage CVE-2026-109449

Exploitable only when the application parses attacker-controlled (untrusted) expressions through the ExpressionLanguage component - most directly via the #[Assert\ExpressionSyntax] / ExpressionLanguageSyntax validator which passes the validated value to ExpressionLanguage::lint(), or via any direct call to ExpressionLanguage::parse()/lint() on user input. The required payload is a single expression with extreme nesting depth (the fix caps nesting at 256 levels; tests use ~300 nested unary operators, parentheses, array/hash literals, binary operators, property accesses or ternaries). Limiting factor: applications that only evaluate developer-authored or hard-coded expressions never expose attacker-controlled input to the parser and are not realistically exploitable; impact is confined to availability (process crash) with no data exposure or code execution.

This is a genuine availability-only denial-of-service issue (CWE-674 unbounded recursion) in Symfony's ExpressionLanguage parser. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated condition with HIGH availability impact and no confidentiality or integrity impact (VC:N/VI:N/VA:H), which is internally consistent - the flaw crashes the PHP worker process via native stack overflow while the oversized node tree is being freed, with no code execution. The headline 8.7 score is driven entirely by the ease of triggering, not by impact breadth. No EPSS score was provided and the issue is NOT in CISA KEV, so there is no evidence of active exploitation; treat exploitation status as 'no public exploit identified at time of analysis.' A critical caveat: the AV:N/PR:N/UI:N metrics assume the vulnerable code path is actually reachable with attacker-controlled input - this flaw is only exploitable in applications that parse UNTRUSTED expressions (e.g. validating user-written expressions via #[Assert\ExpressionSyntax], which calls ExpressionLanguage::lint()). Applications that only parse developer-authored expressions are effectively unaffected regardless of the CVSS vector. Net: real but conditional priority - patch promptly where untrusted expressions are parsed, lower urgency elsewhere; it is a resource-exhaustion DoS, not RCE.

An application exposes a field that validates user-supplied Symfony expressions (for example via the ExpressionSyntax constraint, which internally calls ExpressionLanguage::lint()). An unauthenticated attacker submits a single request containing an expression built from tens of thousands of nested unary operators, array literals, or property accesses; parsing builds an unbounded node tree whose destruction overflows the native stack and crashes the PHP process, denying service. No public weaponized exploit is identified, though the vendor's regression tests disclose the exact trigger pattern (e.g. str_repeat('!',300).'1').