CVE-2026-45305
published 2026-07-14CVE-2026-45305: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12…
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.80%
53.0th percentile
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser::cleanup() used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup, allowing crafted input to make parsing hang for an arbitrarily long time. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sensiolabs | symfony | < 5.4.52 | 5.4.52 |
| sensiolabs | symfony | >= 6.0.0 < 6.4.40 | 6.4.40 |
| sensiolabs | symfony | >= 7.0.0 < 7.4.12 | 7.4.12 |
| sensiolabs | symfony | >= 8.0.0 < 8.0.12 | 8.0.12 |
| symfony | symfony | < 5.4.52 | 5.4.52 |
| symfony | symfony | — | — |
| symfony | symfony | — | — |
| symfony | symfony | — | — |
| symfony | symfony | >= 0 < 5.4.52 | 5.4.52 |
| symfony | symfony | >= 6.0.0 < 6.4.40 | 6.4.40 |
| symfony | symfony | >= 7.0.0 < 7.4.12 | 7.4.12 |
| symfony | symfony | >= 8.0.0 < 8.0.12 | 8.0.12 |
| symfony | yaml | < 5.4.52 | 5.4.52 |
| symfony | yaml | — | — |
| symfony | yaml | — | — |
| symfony | yaml | — | — |
| symfony | yaml | >= 0 < 5.4.52 | 5.4.52 |
| symfony | yaml | >= 6.0.0 < 6.4.40 | 6.4.40 |
| symfony | yaml | >= 7.0.0 < 7.4.12 | 7.4.12 |
| symfony | yaml | >= 8.0.0 < 8.0.12 | 8.0.12 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Symfony YAML Parser Parser::cleanup redos (frc-8383-795)
vuldb·2026-05-28
CVE-2026-45305 [LOW] Symfony YAML Parser Parser::cleanup redos (frc-8383-795)
A vulnerability was found in Symfony. It has been declared as problematic. Affected is the function Parser::cleanup of the component YAML Parser. Executing a manipulation can lead to inefficient regular expression complexity.
The identification of this vulnerability is CVE-2026-45305. The attack may be launched remotely. There is no exploit available.
It is recommended to upgrade the affected component.
GHSA
Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
ghsa·2026-05-27
CVE-2026-45305 [LOW] CWE-1333 Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
### Description
`Symfony\Component\Yaml\Parser::cleanup()` strips the optional `%YAML` directive header, leading comments, and document start/end markers before parsing. The original regexes contained overlapping quantifiers, most notably `'#^%YAML[: ][\d.]+.*\n#u'`, whose `[\d.]+` and `.*` overlap on the dot, that exhibit catastrophic backtracking on crafted input. A single oversized `%YAML` directive header (or comment / document-marker line) makes the parser hang for an arbitrarily long time, denying service.
### Resolution
The four regexes in `Parser::cleanup()` (YAML directive header, leading comments, document-start marker, document-end marker) have been rewritten with possessive quantifier
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/symfony/symfony/commit/9749cd43c5e09b3735093623670b21b9d8a056cbhttps://github.com/symfony/symfony/releases/tag/v5.4.52https://github.com/symfony/symfony/releases/tag/v6.4.40https://github.com/symfony/symfony/releases/tag/v7.4.12https://github.com/symfony/symfony/releases/tag/v8.0.12https://github.com/symfony/symfony/security/advisories/GHSA-9frc-8383-795m
2026-07-14
Published