Uncontrolled Recursion in Symfony - CVE-2026-109413

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in Symfony's YAML inline lexer, specifically YamlParser::lexInlineStructure(), when lexing deeply nested inline collections without enforcing the parser's nesting limit. A remote attacker can submit a single specially crafted YAML request to exhaust the stack and cause a denial of service through a process crash or fatal request error.

Exploitation through #[MapRequestPayload] requires the Yaml component to be installed and the endpoint to accept YAML without an acceptFormat restriction. Whether stack exhaustion crashes the process or terminates the request with a fatal error depends on the PHP version and stack settings.

Affected software

How to mitigate CVE-2026-109413

External References

• https://github.com/symfony/symfony/security/advisories/GHSA-2v3c-qxhr-7vpv
• https://github.com/symfony/symfony/commit/2a8bf9c58d862b0c76a35ce288d1ba6a27223aad

Related Security Bulletins

• Uncontrolled Recursion in Symfony