ReDoS in Symfony YAML Parser via Overlapping Quantifiers

Executive Summary

CVE-2026-45305 is a Regular Expression Denial of Service (ReDoS) vulnerability in the Symfony YAML parser component. The issue occurs in the Symfony\Component\Yaml\Parser::cleanup() method, where regular expressions with overlapping quantifiers are used to clean up YAML directives, comments, and document markers.

Specifically, the vulnerability arises from catastrophic backtracking in the regex patterns. For example, the pattern '#^%YAML[: ][\d.]+.*\n#u' has overlapping quantifiers ([\d.]+ and .*), where the dot character can match the same input in both parts of the regex. This allows crafted input, such as an oversized %YAML directive header, comment, or document marker, to cause the parser to hang indefinitely, consuming excessive resources.

The vulnerability affects Symfony versions prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12. It was fixed by rewriting the problematic regexes to use possessive quantifiers and unambiguous character classes, preventing the backtracking issue.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability involves checking if your system is running an affected version of Symfony or the symfony/yaml component. You can inspect your project's dependencies to verify the installed versions.

• Check Symfony version in a PHP project: Run `composer show symfony/symfony` or `composer show symfony/yaml` to see the installed version. Compare the output with the affected version ranges (<5.4.52, >=6.0 <6.4.40, >=7.0 <7.4.12, or >=8.0 <8.0.12).
• Inspect YAML parsing behavior: If you process untrusted YAML input, monitor for unusually long parsing times or hanging processes when parsing large or malformed YAML files, especially those with oversized %YAML headers, comments, or document markers.
• Use static analysis tools: Tools like PHPStan or Psalm with security plugins may flag outdated dependencies, including vulnerable versions of Symfony or symfony/yaml.

There are no specific network-based detection methods for this vulnerability, as it is a local denial-of-service issue triggered by crafted YAML input.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you in the following ways:

• Denial of Service (DoS): An attacker can craft malicious YAML input that causes the Symfony YAML parser to hang indefinitely. This can lead to excessive CPU and memory usage, resulting in a denial of service condition for your application.
• Service Disruption: If your application relies on the Symfony YAML parser to process user-supplied or external YAML data, an attacker could exploit this vulnerability to disrupt your service, making it unavailable to legitimate users.
• Resource Exhaustion: The vulnerability can cause resource exhaustion on the server, potentially affecting other applications or services running on the same infrastructure.

The impact is particularly severe if your application processes YAML input from untrusted sources, such as user uploads, API requests, or third-party integrations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can affect compliance with common standards and regulations in the following ways:

• GDPR (General Data Protection Regulation): While the vulnerability itself does not directly expose personal data, a denial of service attack could disrupt services that process or store personal data. Under GDPR, organizations must ensure the availability and resilience of processing systems (Article 32). A successful attack could violate these requirements, potentially leading to non-compliance.
• HIPAA (Health Insurance Portability and Accountability Act): For organizations handling protected health information (PHI), a denial of service attack could disrupt access to critical systems. HIPAA requires covered entities to ensure the confidentiality, integrity, and availability of PHI (Security Rule, §164.306). A prolonged outage due to this vulnerability could result in non-compliance.
• Other Standards: Compliance frameworks like ISO 27001, SOC 2, or PCI DSS emphasize the importance of system availability and security. A ReDoS vulnerability could be seen as a failure to implement adequate security controls, potentially leading to compliance violations.

To maintain compliance, it is critical to apply the available patches or mitigations to address this vulnerability promptly.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade Symfony or the symfony/yaml component to a patched version. If upgrading is not immediately possible, consider the following steps:

• Upgrade Symfony: Update to Symfony 5.4.52, 6.4.40, 7.4.12, or 8.0.12 (or later) using Composer. Run `composer update symfony/symfony` or `composer update symfony/yaml` depending on your setup.
• Apply input validation: If you cannot upgrade, restrict the size and structure of YAML input processed by the application. Reject or truncate inputs with unusually large %YAML headers, comments, or document markers.
• Isolate YAML parsing: Run YAML parsing in a sandboxed or time-limited environment to prevent prolonged hangs from affecting system availability.
• Monitor for exploitation: Set up logging and monitoring for slow or hanging YAML parsing operations, which may indicate attempted exploitation.

Useful 0 Not Useful 0