EUVD-2026-44351
GHSA-c2p3-7m5p-cv8x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify endpoint parsing untrusted YAML
-
DeliveryCraft deeply nested YAML payload
-
ExploitSubmit to Yaml::parse()
-
ExecutionTrigger unbounded parser recursion
-
PersistExhaust PHP stack, crash worker
-
ImpactRepeat to sustain denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Recursion depth limits
|
| Exploitation Conditions | Exploitation requires that the application pass attacker-controlled input into the Symfony YAML parser via Yaml::parse(), Yaml::parseFile(), or Inline parsing - this is the concrete prerequisite reflected by the CVSS 4.0 AT:P (attack requirement present) metric and the advisory phrase 'when the parser is exposed to attacker-controlled input.' The attacker then supplies a document with deeply nested mappings or sequences exceeding the PHP stack capacity. Limiting factors: applications that only parse trusted, developer-controlled configuration files are not exposed; no authentication is required where the parser is reachable (PR:N/UI:N), and after patching, the default 128-level nesting cap (or a lower configured $maxNestingLevel) neutralizes the payload. Impact is limited to availability - no data disclosure or code execution. |
| Impact | Signals are internally consistent and point to a real-but-bounded availability risk. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) rates it 8.2 High, with impact confined to availability (VA:H; VC:N/VI:N - no confidentiality or integrity exposure), which matches a pure DoS and the CWE-674 classification. The AT:P (attack requirement present) metric is the key nuance: exploitation is only reachable when the application actually feeds attacker-controlled input into the YAML parser, which is not the default for many Symfony apps that only parse trusted local config files. Corroborating this, EPSS is very low (0.09%, 26th percentile), the CVE is not in CISA KEV, and no public exploit is identified. There are no conflicting signals - the low EPSS and High CVSS are reconciled by the fact that CVSS scores worst-case impact while real-world exposure depends on whether untrusted YAML reaches the parser. Net: patch on a normal cadence; prioritize only where YAML input is user- or network-facing. |
| Exploit ScenarioDerived | An application exposes an endpoint or job that parses YAML supplied by a remote user (for example an import feature, API payload, or webhook) through Yaml::parse(). The attacker submits a small document containing hundreds of nested sequence or mapping openers ('[[[[...' or '{{{...'), which drives the parser into unbounded recursion and exhausts the PHP stack, crashing the worker; repeating the request denies service to legitimate users. No public exploit code is identified, but the payload is trivial to construct and requires no authentication where the parser is reachable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 14, 2026
Denial of service in the Symfony Yaml component (symfony/yaml and the symfony/symfony monolith) lets remote attackers crash PHP worker processes by submitting a YAML document with deeply nested mappings or sequences. Because neither the block-level parser (Parser::parseBlock()) nor the inline parser (Inline::parseSequence()/parseMapping()) enforced a recursion depth limit, a compact crafted payload exhausts the PHP call stack, killing the process. EPSS is low (0.09%, 26th percentile) and there is no public exploit identified at time of analysis, but the bug is trivially triggerable wherever untrusted YAML is parsed.
Earlier versions of this analysis (1)
Unbounded recursion in Symfony's YAML component (symfony/yaml) crashes PHP worker processes when parsing attacker-controlled documents containing deeply nested mappings or sequences. Both the block-level parser (Parser::parseBlock()) and inline parsers (Inline::parseSequence(), Inline::parseMapping()) recurse without a depth ceiling, allowing a single crafted YAML document to exhaust the PHP call stack and kill the worker. All applications that pass untrusted input to Yaml::parse() or Yaml::parseFile() across symfony/yaml 5.4.x through 7.x are affected; no public exploit is identified at time of analysis, and this vulnerability is not listed in CISA KEV.
RemediationAI
Vendor-released patch: upgrade to symfony/yaml or symfony/symfony 5.4.52, 6.4.40, 7.4.12, or 8.0.12 depending on your branch (run composer update symfony/yaml or composer update symfony/symfony to the matching fixed release). The corresponding upstream fix is commit 914f427ed9630ddb3904dafba763e53d9f133fe3, and remediation guidance is in advisory GHSA-c2p3-7m5p-cv8x (https://github.com/symfony/symfony/security/advisories/GHSA-c2p3-7m5p-cv8x) and https://symfony.com/cve-2026-45133. If you cannot upgrade immediately, the effective compensating control is to avoid passing untrusted input to Yaml::parse()/Yaml::parseFile(); where user-supplied YAML must be accepted, cap input size and reject documents with excessive nesting before parsing (a pre-parse depth or bracket/indent check), accepting the trade-off that overly strict limits may reject legitimate deeply structured documents. After upgrading you can also set the new $maxNestingLevel argument below the default 128 to further constrain depth for hostile inputs, at the cost of rejecting unusually nested but valid data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 6 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected technology is Symfony's YAML parser, the reference PHP YAML implementation used broadly across Symfony applications for configuration and, in some apps, for handling user- or API-supplied data via Yaml::parse()/Yaml::parseFile(). The root cause is CWE-674 (Uncontrolled Recursion): parsing descends recursively for each nested collection level with no ceiling, so nesting depth in the input maps directly to native PHP stack frame consumption. Once the stack limit is hit the interpreter aborts the process rather than throwing a catchable error. The fix introduces a shared ParserState object that tracks depth across both block and inline parsing paths and enforces a default limit of 128 levels, configurable through a new $maxNestingLevel argument on Parser::__construct(), Yaml::parse() and Yaml::parseFile(). CPE data confirms the Composer packages symfony/yaml and the symfony/symfony monolith as affected.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable and low-complexity once untrusted YAML reaches the parser, no auth or interaction (PR:N/UI:N); impact is availability-only DoS, so C:N/I:N/A:H - CVSS 3.1 cannot express the app-dependent attack requirement.
Primary rating from Vendor (https://github.com/symfony/symfony).
CVSS VectorVendor: https://github.com/symfony/symfony
Lifecycle Timeline
2DescriptionCVE.org
Description
Symfony\Component\Yaml\Parser is the entry point for parsing YAML strings into PHP values via Yaml::parse(). When the parser is exposed to attacker-controlled input, deeply nested mappings or sequences cause both the block-level (Parser::parseBlock()) and inline (Inline::parseSequence() / Inline::parseMapping()) parsers to recurse without a depth limit. A crafted document exhausts the PHP stack and crashes the worker.
Resolution
The Parser now tracks recursion depth in a shared ParserState object across both block-level and inline parsing, with a default limit of 128. The limit is configurable via a new $maxNestingLevel argument on Parser::__construct(), Yaml::parse() and Yaml::parseFile().
The patch for this issue is available here for branch 5.4.
Credits
Symfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it.
Executive ViewAI
Symfony Yaml component vulnerability (CVE-2026-45133) allows remote denial-of-service attacks that crash application worker processes, potentially rendering services unavailable. Organizations running Symfony with YAML parsing must prioritize patching to prevent unplanned service disruptions.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB