XML Entity Expansion in Symfony - CVE-2026-45304

Detailed vulnerability description

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper restriction of recursive entity references in Symfony\Component\Yaml\Parser when parsing untrusted YAML containing recursive collection aliases. A remote attacker can supply a specially crafted YAML document to cause a denial of service.

A small input can expand into a multi-gigabyte structure and exhaust memory through exponential alias expansion.

How to mitigate CVE-2026-45304

Sources

• https://github.com/symfony/symfony/security/advisories/GHSA-4qpc-3hr4-r2p4
• https://github.com/symfony/symfony/commit/e77391b2e4f18821198f010d573674c8ed4a970a