CVE-2026-45133

Analyzed Analyzed - Analysis Complete

Stack Overflow in Symfony YAML Parser

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, when the parser is exposed to attacker-controlled input, deeply nested mappings or sequences cause both the block-level (Parser::parseBlock()) and inline (Inline::parseSequence() / Inline::parseMapping()) parsers to recurse without a depth limit. A crafted document exhausts the PHP stack and crashes the worker. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-45133

EUVD

EUVD-2026-44351

Affected Vendors & Products

Vendor	Product	Version / Range
sensiolabs	symfony	From 7.0.0 (inc) to 7.4.12 (exc)
sensiolabs	symfony	From 8.0.0 (inc) to 8.0.12 (exc)
sensiolabs	symfony	to 5.4.52 (exc)
sensiolabs	symfony	From 6.0.0 (inc) to 6.4.40 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CWE-776	The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This vulnerability is a stack exhaustion issue in Symfony's YAML parser caused by unbounded recursion in deeply nested mappings, sequences, or blocks. When parsing attacker-controlled YAML input with excessive nesting, the parser's block-level and inline parsers recurse without a depth limit, consuming the PHP stack and crashing the worker process.

Detection Guidance

Check Symfony and symfony/yaml package versions using commands like 'composer show symfony/symfony' or 'composer show symfony/yaml'. If versions are below 5.4.52, 6.4.40, 7.4.12, or 8.0.12, the system is vulnerable. Monitor for crashes during YAML parsing tasks.

Impact Analysis

This vulnerability can cause denial-of-service by crashing the application or worker process when processing malicious YAML input. It may lead to service disruption, downtime, or degraded performance for applications using affected Symfony versions.

Mitigation Strategies

Upgrade Symfony and symfony/yaml to versions 5.4.52, 6.4.40, 7.4.12, or 8.0.12 or later. If upgrading is not immediately possible, implement input validation for YAML files and limit nesting depth in parser configurations.

Hi! I’m here to help you understand CVE-2026-45133. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70