high · 8.7 Patched

Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process

CVE-2026-109413 · GHSA-2v3c-qxhr-7vpv · published 27 Oct 2026

How serious is it

Severity: high, CVSS score 8.7 out of 10.
No exploit prediction (EPSS) score yet.
Not on the CISA list of exploited vulnerabilities.
No public exploit in Exploit-DB.

Is your app affected by CVE-2026-109413?

Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.

Who is affected

symfony/symfony (Packagist) >= 2.0.0, < 5.4.54
symfony/symfony (Packagist) >= 6.0.0, < 6.4.45
symfony/symfony (Packagist) >= 7.0.0, < 7.4.18
symfony/symfony (Packagist) >= 8.0.0, < 8.1.6
symfony/yaml (Packagist) >= 2.0.0, < 5.4.54
symfony/yaml (Packagist) >= 6.0.0, < 6.4.45
symfony/yaml (Packagist) >= 7.0.0, < 7.4.18
symfony/yaml (Packagist) >= 8.0.0, < 8.1.6

How to check

Run composer show symfony/symfony in your project to see the installed version, including copies pulled in by other packages.
Run composer show symfony/yaml in your project to see the installed version, including copies pulled in by other packages.
Or paste your lockfile into the checker: it lists every package with a known vulnerability, this one included.

How to fix

Copies a prompt for Claude Code, Cursor or Codex: it checks your lockfiles for this and upgrades it.

On >= 2.0.0, < 5.4.54: Upgrade symfony/symfony to 5.4.54 or later, commit the lockfile and redeploy.
On >= 6.0.0, < 6.4.45: Upgrade symfony/symfony to 6.4.45 or later, commit the lockfile and redeploy.
On >= 7.0.0, < 7.4.18: Upgrade symfony/symfony to 7.4.18 or later, commit the lockfile and redeploy.
On >= 8.0.0, < 8.1.6: Upgrade symfony/symfony to 8.1.6 or later, commit the lockfile and redeploy.
On >= 2.0.0, < 5.4.54: Upgrade symfony/yaml to 5.4.54 or later, commit the lockfile and redeploy.
On >= 6.0.0, < 6.4.45: Upgrade symfony/yaml to 6.4.45 or later, commit the lockfile and redeploy.
On >= 7.0.0, < 7.4.18: Upgrade symfony/yaml to 7.4.18 or later, commit the lockfile and redeploy.
On >= 8.0.0, < 8.1.6: Upgrade symfony/yaml to 8.1.6 or later, commit the lockfile and redeploy.
If a vulnerable version was live, check your logs and rotate the secrets that server could read.

The advisory

### Description `Yaml\Parser::lexInlineStructure()` recursed through `lexInlineMapping()` and `lexInlineSequence()` for every `{` and `[` of an inline collection, without entering the nesting level that the rest of the parser bounds with `maxNestingLevel`. A document made of deeply nested inline collections, such as `[[[[...]]]]`, exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error. Any code parsing untrusted YAML is affected. That includes `#[MapRequestPayload]` when the Yaml component is installed and the endpoint does not restrict `acceptFormat`: a single unauthenticated request with a YAML content type is enough. ### Resolution The inline lexer now enters and leaves the same nesting level as the rest of the parser, so nested inline collections are bounded by `maxNestingLevel`, and the parser raises a `ParseException` beyond it. The patches for this issue are available [here](https://github.com/symfony/symfony/commit/2a8bf9c58d862b0c76a35ce288d1ba6a27223aad) for branch 5.4 (and forward-ported to 6.4, 7.4, 8.1 and 8.2). ### Credits We would like to thank Nicolas Grekas for reporting the issue and providing the fix. ### References - Fix: [#65688](https://github.com/symfony/symfony/pull/65688)

Check your whole app

Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.

References

Merged from GitHub Advisory Database, OSV. Last updated 28 Oct 2026. All vulnerabilities · RSS · JSON

Get alerts for new exploited vulnerabilities