Is there a patch available for CVE-2026-49209?

Yes, a patch is available for CVE-2026-49209. Update the affected software to the latest version immediately.

Symfony LiveComponent CVE-2026-49209

Q: What is the CVSS score of CVE-2026-49209?

CVE-2026-49209 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-45208 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-06-19 https://github.com/symfony/ux

GHSA-mm82-c99c-h2cf

Denial Of Service

5.3

CVSS 4.0 · Vendor: https://github.com/symfony/ux

Severity by source

Vendor (https://github.com/symfony/ux) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable _batch endpoint requires only a valid authenticated session (PR:L); trivial to craft; sole impact is availability exhaustion with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/symfony/ux).

CVSS VectorVendor: https://github.com/symfony/ux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 17, 2026 - 17:22 NVD

5.3 (MEDIUM)

Source Code Evidence Fetched

Jun 19, 2026 - 21:42 vuln.today

Analysis Generated

Jun 19, 2026 - 21:42 vuln.today

DescriptionCVE.org

Description

Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke() iterates over the client-supplied actions array and issues a full HttpKernel sub-request for each entry (event subscribers, validators, Doctrine, rendering). The array size is never bounded, so an authenticated client can submit a single _batch request containing thousands of actions and exhaust CPU, memory, and database connections on the application server.

Resolution

BatchActionController now enforces an upper bound of 50 actions per _batch request (MAX_ACTIONS_PER_BATCH) and rejects larger payloads up front with a BadRequestHttpException. The matching JavaScript backend was also updated to split larger client-side batches into multiple requests so legitimate usage isn't affected.

The patch for this issue is available here for branch 2.x (and forward-ported to 3.x).

Credits

Symfony would like to thank Pascal Cescon for reporting the issue and Hugo Alliaume for providing the fix.

AnalysisAI

Denial of service in symfony/ux-live-component's BatchActionController allows authenticated users to exhaust server CPU, memory, and database connections by submitting a single _batch HTTP request containing an unbounded number of actions. Each action in the client-supplied array triggers a full HttpKernel sub-request - including event subscribers, validators, Doctrine queries, and rendering - with no upper limit on array size. Fixed in versions 2.36.0 and 3.1.0; no public exploit or KEV listing identified at time of analysis.

Technical ContextAI

Symfony UX LiveComponent is a Symfony PHP library enabling real-time, reactive UI components via AJAX. Its BatchActionController::__invoke() method processes a client-submitted JSON array of component actions by issuing internal HttpKernel sub-requests for each entry. These sub-requests are full request-response cycles involving Symfony's event system, form validators, Doctrine ORM, and Twig rendering - making each entry significantly more expensive than a simple function call. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the controller never validates or caps the length of the incoming actions array before entering the processing loop. Affected packages are pkg:composer/symfony/ux-live-component in the 2.x branch (>= 2.5.0, < 2.36.0) and the 3.x branch (>= 3.0.0, < 3.1.0), as identified by the GHSA advisory CPE data.

RemediationAI

Upgrade symfony/ux-live-component to version 2.36.0 (for 2.x consumers) or 3.1.0 (for 3.x consumers) via Composer: run 'composer update symfony/ux-live-component'. The patch introduces a MAX_ACTIONS_PER_BATCH constant of 50 on both the PHP server side (BatchActionController) and the JavaScript client side, with the server rejecting oversized payloads via BadRequestHttpException and the JS client transparently splitting larger batches into sequential requests. The upstream fix commit is available at https://github.com/symfony/ux/commit/95e878d5257f13d6d652ca95e3ef6bb0934d674f. If an immediate upgrade is not feasible, a compensating control is to place a web application firewall or reverse proxy rule that enforces a maximum request body size or payload element count on POST requests to the _batch endpoint path. Restricting the _batch route to trusted internal IP ranges or requiring elevated authentication for that specific endpoint are additional options; however, both may break legitimate batch functionality for end users. Rate limiting per authenticated session on the _batch route (e.g., via nginx limit_req or Symfony's rate limiter component) reduces the blast radius without fully closing the vulnerability.