CVE-2026-45304

Analyzed Analyzed - Analysis Complete

Memory Exhaustion in Symfony YAML Parser

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser resolved YAML collection aliases recursively, allowing a small untrusted YAML input to expand into a multi-gigabyte structure and exhaust memory. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-45304

EUVD

EUVD-2026-44358

Affected Vendors & Products

Vendor	Product	Version / Range
sensiolabs	symfony	From 7.0.0 (inc) to 7.4.12 (exc)
sensiolabs	symfony	From 8.0.0 (inc) to 8.0.12 (exc)
sensiolabs	symfony	to 5.4.52 (exc)
sensiolabs	symfony	From 6.0.0 (inc) to 6.4.40 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-776	The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Symfony PHP framework's YAML parser. It allows a small, specially crafted YAML input to trigger recursive expansion of collection aliases, consuming excessive memory and potentially causing a denial-of-service attack. The issue is fixed in Symfony versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Detection Guidance

To detect this vulnerability, check the Symfony version in use with commands like 'composer show symfony/symfony' or 'php -r "echo Symfony\Component\Yaml\Yaml::VERSION;"'. If the version is below 5.4.52, 6.4.40, 7.4.12, or 8.0.12, the system is vulnerable. Monitor for unusual memory consumption during YAML parsing operations.

Impact Analysis

An attacker could exploit this to crash your application or server by sending a maliciously crafted YAML file, leading to resource exhaustion. Systems processing untrusted YAML inputs are particularly at risk of denial-of-service.

Mitigation Strategies

Upgrade Symfony to versions 5.4.52, 6.4.40, 7.4.12, or 8.0.12 or later. If upgrading is not immediately possible, implement input validation for YAML files and limit the size of parsed documents. Use the new $maxAliasesForCollections parameter to restrict collection alias expansions to a safe default of 128.

Hi! I’m here to help you understand CVE-2026-45304. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70