Uncontrolled Recursion in Symfony - CVE-2026-45133
Published: May 21, 2026
Vulnerability identifier: #VU132075
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-45133
CWE-ID: CWE-674
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in Symfony\Component\Yaml\Parser when parsing attacker-controlled YAML input with deeply nested blocks, sequences, or mappings. A remote attacker can supply a specially crafted YAML document to cause a denial of service.
The issue can exhaust the PHP stack and crash the worker.
Affected software
Symfony
Debian Linux
symfony (Debian package)
Debian Linux
symfony (Debian package)
How to mitigate CVE-2026-45133
Install security update from vendor's website.
Symfony - addressed in versions 5.4.52, 6.4.40, 7.4.12, 8.0.12
symfony (Debian package) - addressed in versions 5.4.53+dfsg-0+deb12u1, 6.4.41+dfsg-0+deb13u1
symfony (Debian package) - addressed in versions 5.4.53+dfsg-0+deb12u1, 6.4.41+dfsg-0+deb13u1