CVE-2026-109413

published 2026-10-15

CVE-2026-109413: In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and…

Priority P3 56 high 8.7 CVSS 4.0

AV N AC L AT N PR N UI N VC N VI N VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A document made of deeply nested inline collections, such as [[[[...]]]], exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error.

Any code parsing untrusted YAML is affected. That includes #[MapRequestPayload] when the Yaml component is installed and the endpoint does not restrict acceptFormat: a single unauthenticated request with a YAML content type is enough.

This issue affects symfony/yaml through v5.4.53, v6.0.0-BETA1 through v6.4.44, v7.0.0-BETA1 through v7.4.17, and v8.0.0-BETA1 through v8.1.5.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
sensiolabs	symfony	< v5.4.54	v5.4.54
sensiolabs	symfony	>= v6.0.0-BETA1 < v6.4.45	v6.4.45
sensiolabs	symfony	>= v7.0.0-BETA1 < v7.4.18	v7.4.18
sensiolabs	symfony	>= v8.0.0-BETA1 < v8.1.6	v8.1.6
symfony	symfony	>= 2.0.0 < 5.4.54	5.4.54
symfony	symfony	>= 6.0.0 < 6.4.45	6.4.45
symfony	symfony	>= 7.0.0 < 7.4.18	7.4.18
symfony	symfony	>= 8.0.0 < 8.1.6	8.1.6
symfony	yaml	>= 2.0.0 < 5.4.54	5.4.54
symfony	yaml	>= 6.0.0 < 6.4.45	6.4.45
symfony	yaml	>= 7.0.0 < 7.4.18	7.4.18
symfony	yaml	>= 8.0.0 < 8.1.6	8.1.6

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-674