HighVulnerabilityCVE-2026-109413updated 27 Oct 2026, 19:01 UTC

Symfony YAML parser can be crashed by deeply nested input

Sending a specially crafted YAML document with very deep nesting can make the application crash or return an error. Anyone can send such a request, including unauthenticated visitors of affected endpoints.

Fix availableOfficial source

Severity	HighCVSS 8.7 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	Yessymfony/symfony and symfony/yaml 5.4.54, 6.4.45, 7.4.18, 8.1.6 or later · since 27 Oct 2026
How sure is this?	Official sourceBacked by an official source

How the attack works simplified

1AttackerSends a crafted YAML request
2Public endpointAccepts YAML without format restriction
3Yaml parserLexes deeply nested inline collections
4Stack exhaustedRecursion has no nesting limit
ResultProcess crashes or request fails with fatal error

What happened

The Symfony Yaml component's inline lexer recursed through inline mappings and sequences without enforcing the maxNestingLevel limit, so deeply nested inline collections such as [[[[...]]]] exhaust the call stack during lexing.

Why it is dangerous: An attacker can crash or disrupt a PHP process or request with a single small payload, causing denial of service for applications that parse untrusted YAML.

Are you affected?

You are affected if you use Symfony components symfony/symfony or symfony/yaml in the vulnerable version ranges below and parse untrusted YAML, including endpoints using #[MapRequestPayload] with the Yaml component installed and no acceptFormat restriction.

Package / product	Affected versions	Fixed in
symfony/symfony · composer	>= 2.0.0, < 5.4.54	5.4.54
symfony/symfony · composer	>= 6.0.0, < 6.4.45	6.4.45
symfony/symfony · composer	>= 7.0.0, < 7.4.18	7.4.18
symfony/symfony · composer	>= 8.0.0, < 8.1.6	8.1.6
symfony/yaml · composer	>= 2.0.0, < 5.4.54	5.4.54
symfony/yaml · composer	>= 6.0.0, < 6.4.45	6.4.45
symfony/yaml · composer	>= 7.0.0, < 7.4.18	7.4.18
symfony/yaml · composer	>= 8.0.0, < 8.1.6	8.1.6

What to do

Update symfony/symfony and symfony/yaml to 5.4.54, 6.4.45, 7.4.18 or 8.1.6 (whichever matches your branch) or later
If you cannot update yet, restrict accepted formats on YAML request endpoints (acceptFormat) so untrusted YAML is rejected
Verify that the Yaml component's maxNestingLevel behavior is in effect after upgrading

Timeline

27 Oct 2026, 19:01 UTC
Publicly disclosed
27 Oct 2026, 19:01 UTC
Reported by GitHub Advisory · GitHub Advisory
27 Oct 2026, 19:01 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the ProcessGitHub Advisory · 27 Oct 2026, 19:01 UTC

Technical details

ID: CVE-2026-109413 · GHSA-2v3c-qxhr-7vpv
CVSS: 8.7 / 10
EPSS: 0.4% chance of exploitation within 30 days
Disclosed: 27 Oct 2026, 19:01 UTC
On Zero Radar: 27 Oct 2026, 19:01 UTC (0 min after disclosure)
Last change: 27 Oct 2026, 19:01 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works