Symfony YAML EUVD-2026-102109

Exploitation requires the application to parse untrusted YAML through the symfony/yaml component at an affected version (prior to 5.4.54, 6.4.45, 7.4.18, or 8.1.6). The highest-exposure path is a controller using the #[MapRequestPayload] attribute when the Yaml component is installed AND the endpoint does not restrict acceptFormat, allowing a single unauthenticated request with a YAML content type to reach the parser. The required payload is a deeply nested inline collection (e.g. [[[[...]]]] or {{{...) exceeding available stack depth. LIMITING FACTORS: applications that never pass attacker-controlled input to Yaml::parse()/Parser::parse() are not exploitable; endpoints that restrict acceptFormat (e.g. to JSON) block the MapRequestPayload vector; and the concrete outcome (process crash vs. fatal error) depends on the PHP version and its stack settings.

This is a genuine but bounded risk. All signals point to a denial-of-service-only flaw: the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated trigger, but impact is confined to availability (VC:N/VI:N/VA:H) with no confidentiality or integrity loss, consistent with the CWE-674 unbounded-recursion/stack-exhaustion mechanism. The assigned 8.7 (HIGH) is driven almost entirely by the ease of reaching the code path rather than by impact severity. No EPSS score was provided and the vulnerability is NOT listed in CISA KEV; no public exploit identified at time of analysis. The practical priority is therefore moderate-to-high specifically for deployments that parse attacker-controlled YAML (notably #[MapRequestPayload] endpoints that accept a YAML content type), and low for applications that only parse trusted/internal YAML. Note one nuance to verify: the description frames the most dangerous entry point (#[MapRequestPayload]) as conditional on the Yaml component being installed and the endpoint not restricting acceptFormat, so the AV:N/PR:N/UI:N vector is accurate for that configuration but overstates exposure for apps that never expose YAML parsing to untrusted input.

An attacker sends a single unauthenticated HTTP request with a YAML content type to a Symfony application that parses the body (for example a controller using #[MapRequestPayload] with the Yaml component installed and no acceptFormat restriction). The body is a deeply nested inline collection such as [[[[...]]]], which drives unbounded recursion in Yaml\Parser::lexInlineStructure() and exhausts the PHP stack, crashing the worker or returning a fatal error. No public exploit code is identified, but the payload is trivial to construct.