Symfony Yaml CVE-2026-45305

Exploitation requires that the target application passes attacker-influenced data into Symfony's YAML parser (Yaml::parse / Parser::parse) - the vulnerable code path is Parser::cleanup(), which only runs when the input begins with a preamble line: a '%YAML' directive header, one or more leading '#' comment lines, a '---' document-start marker, or a trailing '...' document-end marker. The attacker controls that preamble line and makes it oversized (the advisory's tests use ~100,000-character headers and ~140,000-character comments/markers) to trigger catastrophic backtracking. The CVSS vector is AV:N/AC:L/PR:N/UI:N, so no authentication or user interaction is required at the protocol level. The real limiting factor is application design: if the app never parses untrusted YAML - only trusted, developer-authored config files - the vulnerability is not reachable by external attackers, so realistic exposure hinges on whether YAML parsing is fed external input.

The signals are internally consistent but point to a moderate, availability-only issue rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) scores 8.7 driven entirely by VA:H (availability high) with no confidentiality or integrity impact - it is purely a DoS. EPSS is very low (0.08%, 23rd percentile), the CVE is not on CISA KEV, and the tag is simply 'Denial Of Service', all reinforcing that this is not being mass-exploited. The important caveat: the network/unauthenticated rating is only realized when the target application actually feeds attacker-controlled data into the YAML parser (e.g., user-uploaded config, API payloads). Applications that only parse trusted, developer-authored YAML face negligible real-world risk despite the high base score. This is a patch-in-normal-maintenance-window issue, not a drop-everything one, unless the app exposes YAML parsing to untrusted input.

An attacker submits a YAML payload to any endpoint that eventually calls Symfony's YAML parser - for example an API field, uploaded configuration file, or webhook body - containing a '%YAML:' header (or leading comment) padded with tens of thousands of characters, mirroring the patch's own test case ("%YAML:" followed by 100,000 '1' characters). The parser enters catastrophic backtracking and pins a CPU core, and repeating the request across worker processes exhausts the server's capacity, denying service to legitimate users. No authentication or user interaction is needed where the parser sits behind unauthenticated input; the trigger strings are documented in the public advisory and test suite though no packaged exploit tool was identified.