What is the CVSS score of CVE-2026-45304?

CVE-2026-45304 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-45304?

Within 24 hours, scan development and production inventories to identify all applications and dependencies using symfony/yaml or symfony/symfony and determine which versions are deployed. Within 7 days, update affected systems to the patched versions: 5.4.52, 6.4.40, 7.4.12, or 8.0.12 as appropriate for each application's version line, prioritizing production systems and public-facing applications that accept YAML input. Within 30 days, validate patches through functional testing, implement or review memory-consumption monitoring and alerting to detect this attack pattern in production, and update incident response procedures to include Yaml memory-exhaustion DoS as a known threat.

Symfony Yaml CVE-2026-45304

Q: Which versions of Symfony Yaml are affected by CVE-2026-45304?

The Symfony Yaml component in versions prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12 is vulnerable to remote denial-of-service attacks that exhaust application memory through specially crafted YAML…. A patch is available.

EUVD-2026-44358 HIGH

Improper Restriction of Recursive Entity References in DTDs (CWE-776)

2026-05-27 https://github.com/symfony/symfony

GHSA-4qpc-3hr4-r2p4

Java Information Disclosure

8.7

CVSS 4.0 · Vendor: https://github.com/symfony/symfony

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify endpoint parsing untrusted YAML
Delivery

Craft nested collection-alias payload
Exploit

Submit YAML to parser
Execution

Trigger exponential alias expansion
Persist

Exhaust process memory
Impact

Denial of service / crash

Vulnerability Assessment

Weakness	CWE CWE-776 OWASP Top 10:2025 A02:2025 - Security Misconfiguration ASVS 5.0 V13 - Configuration XML entity recursion limits
Exploitation Conditions	The only prerequisite is that the target application passes attacker-controlled YAML to Symfony's `Yaml::parse()`/`parseFile()`/`Parser::parse()` on a vulnerable version, and that alias parsing is not already disabled - no authentication, privileges, or user interaction are required (AV:N/AC:L/PR:N/UI:N). The payload must use collection aliases (aliases pointing to arrays, `stdClass`, or `TaggedValue`-wrapped collections); scalar-only aliases cannot trigger the exponential blow-up and are unaffected. Exploitation is limited/prevented when the application does not parse untrusted YAML, when input size is constrained upstream, or when the application already runs a patched version (default cap of 128 collection aliases) or sets `Yaml::PARSE_EXCEPTION_ON_ALIAS`. Impact is bounded to denial of service (memory exhaustion) - there is no data disclosure or code execution.
Impact	The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) scores 8.7 and correctly reflects a network-reachable, unauthenticated, low-complexity attack whose only impact is availability (VA:H) - there is no confidentiality or integrity loss, so this is purely a DoS, not code execution or information disclosure. The EPSS probability is very low (0.08%, 23rd percentile) and the CVE is not on CISA KEV, indicating no observed active exploitation; however EPSS/KEV signals lag and understate a bug this easy to trigger. Real-world risk hinges entirely on exposure: an application is at meaningful risk only if it feeds attacker-controlled YAML into the parser (e.g. an API accepting YAML bodies, uploaded config/manifests). Note two data-quality conflicts to disregard: the input tags claim 'Java' and 'Information Disclosure', both incorrect - this is a PHP component and an availability-only DoS; the impact class should be treated per the CVSS vector and description, not the tags.
Exploit ScenarioDerived	An attacker sends a small YAML payload to an endpoint that parses untrusted YAML with a vulnerable Symfony Yaml version - for example a nested set of collection anchors like `a0: &a0 [foo]` / `a1: &a1 [a0,a0,a0]` / `payload: [a1,a1,a1,...]`. Because collection aliases expand exponentially at resolution time, the parser attempts to build a multi-gigabyte in-memory structure, exhausting PHP memory and crashing the request/worker. No authentication, user interaction, or special privileges are needed (AV:N/AC:L/PR:N/UI:N); no weaponized public exploit is identified, though the patch test cases demonstrate the payload shape.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Jul 14, 2026

Uncontrolled memory consumption in the Symfony Yaml component lets remote attackers trigger a "Billion Laughs" denial-of-service by supplying crafted YAML in which collection aliases recursively reference other alias-bearing collections, expanding a tiny input into a multi-gigabyte structure that exhausts process memory. Affected versions include symfony/yaml and symfony/symfony < 5.4.52, 6.x < 6.4.40, and 7.x < 7.4.12 (with an 8.0.12 release also published). No public exploit identified at time of analysis and EPSS is low (0.08%), but the flaw is trivially reachable by any application parsing untrusted YAML with the affected component.

Earlier versions of this analysis (1)

v1 May 27, 2026 - 22:37

Exponential memory exhaustion in Symfony's YAML parser (symfony/yaml) allows denial of service through crafted YAML documents exploiting the classic 'Billion Laughs' pattern. The Symfony\Component\Yaml\Parser resolves collection aliases (*anchor references to arrays, stdClass, or TaggedValue objects) recursively without any expansion limit, enabling a tiny input document to trigger multi-gigabyte in-memory structures at parse time. Any application that parses untrusted YAML using the affected component versions is vulnerable, spanning symfony/yaml and symfony/symfony packages across the 5.4, 6.x, and 7.x release trains. No public exploit is identified at time of analysis, though the advisory and fix commit include working PoC YAML payloads demonstrating the attack.

RemediationAI

Vendor-released patch: upgrade symfony/yaml (or symfony/symfony) to 5.4.52, 6.4.40, 7.4.12, or 8.0.12 depending on your branch (composer update symfony/yaml); the fix is commit e77391b2e4f18821198f010d573674c8ed4a970a. After upgrading, the parser enforces a default limit of 128 collection-alias resolutions, tunable via the new $maxAliasesForCollections argument on Parser::__construct(), Yaml::parse(), and Yaml::parseFile() - lower it for high-risk endpoints (trade-off: legitimate config files relying on many aliases may be rejected). For fully untrusted input, pass the new Yaml::PARSE_EXCEPTION_ON_ALIAS flag to reject all aliases outright (trade-off: any legitimate use of YAML anchors/aliases will fail). If you cannot upgrade immediately, avoid parsing attacker-controlled YAML, validate/limit input size before parsing, and run YAML parsing in a memory-capped worker so an expansion attempt kills only the worker rather than the host. See the advisory at https://github.com/symfony/symfony/security/advisories/GHSA-4qpc-3hr4-r2p4 and https://symfony.com/cve-2026-45304.

Affected VersionsENISA

symfony 7.0.0-BETA1, < 7.4.12

yaml < 5.4.52

symfony 8.0.0-BETA1, < 8.0.12

symfony < 5.4.52

symfony 6.0.0-BETA1, < 6.4.40

yaml 7.0.0-BETA1, < 7.4.12

yaml 6.0.0-BETA1, < 6.4.40

yaml 8.0.0-BETA1, < 8.0.12

Affected Packages

composer symfony/symfony fix: 5.4.52, 6.4.40, 7.4.12, 8.0.12

composer symfony/yaml fix: 5.4.52, 6.4.40, 7.4.12, 8.0.12

euvd symfony fix: 5.4.52

euvd symfony_6_0_0_beta1 fix: 6.4.40

euvd symfony_7_0_0_beta1 fix: 7.4.12

euvd symfony_8_0_0_beta1 fix: 8.0.12

euvd yaml fix: 5.4.52

euvd yaml_6_0_0_beta1 fix: 6.4.40

euvd yaml_7_0_0_beta1 fix: 7.4.12

euvd yaml_8_0_0_beta1 fix: 8.0.12

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 10 packages in composer, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerable code is Symfony\Component\Yaml\Parser, the pure-PHP YAML parser used across the Symfony ecosystem and many standalone PHP projects that depend on symfony/yaml. YAML supports anchors (&name) and aliases (*name) for referencing previously defined nodes. When an alias points to a collection (a PHP array, stdClass, or a TaggedValue-wrapped collection) and those collections in turn contain further aliases to other collections, resolution multiplies at each level, producing exponential (rather than linear) growth - the canonical XML/YAML entity-expansion attack. This maps to CWE-776 (Improper Restriction of Recursive Entity References, i.e. entity expansion), the same root-cause class as classic 'Billion Laughs' XML attacks. The fix introduces a shared ParserState that counts collection-alias resolutions and caps them at a default of 128 (mirroring SnakeYAML's LoaderOptions), leaves scalar aliases uncounted because they cannot drive exponential growth, and adds a Yaml::PARSE_EXCEPTION_ON_ALIAS flag to reject aliases entirely for fully untrusted input.

Know when Java gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (https://github.com/symfony/symfony) PRIMARY 8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

vuln.today AI 7.5 HIGH

Untrusted YAML is parsed remotely with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is memory-exhaustion DoS only, so C:N/I:N/A:H and scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/symfony/symfony).

CVSS VectorVendor: https://github.com/symfony/symfony

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

None

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Analysis Updated

Jul 14, 2026 - 19:39 vuln.today

v2 - CVSS changed

CVSS changed

Jul 14, 2026 - 19:22 NVD

8.7 (HIGH)

DescriptionCVE.org

Description

Symfony\Component\Yaml\Parser resolves YAML aliases (*anchor) during parsing. Aliases that reference *collections* (arrays, stdClass, TaggedValue-wrapped collections) can themselves point to other collections containing aliases, creating exponential expansion at resolution time. A small input can blow up into a multi-gigabyte structure and exhaust memory: the classic "Billion Laughs" denial-of-service against any parser exposed to untrusted YAML.

Resolution

The Parser now counts collection alias resolutions in a shared ParserState object, with a default limit of 128, following the SnakeYAML model. Scalar aliases remain unrestricted since they cannot drive exponential growth. The limit is configurable via a new $maxAliasesForCollections argument on Parser::__construct(), Yaml::parse() and Yaml::parseFile(). A new Yaml::PARSE_EXCEPTION_ON_ALIAS flag also rejects all aliases outright when parsing fully untrusted input.

The patch for this issue is available here for branch 5.4.

Credits

Symfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it.

Executive ViewAI

Why It Matters

The Symfony Yaml component in versions prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12 is vulnerable to remote denial-of-service attacks that exhaust application memory through specially crafted YAML input. Organizations using affected versions risk complete service unavailability and operational disruption from relatively small malicious inputs. This vulnerability affects any application in scope that processes untrusted YAML data.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.1%

Top 77% exploitable

Prevalence

High

symfony/yaml is a very widely used Composer package across PHP applications and frameworks

Threat Intel

1 source

Social Media

Sightings

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS GHSA CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.