Denial of Service in Symfony JsonPath Component

Executive Summary

CVE-2026-45756 is a vulnerability in the Symfony JsonPath component, which is part of the Symfony PHP framework. The issue affects versions 7.3.0-BETA1 to 7.4.12 and 8.0.0 to 8.0.12.

The vulnerability involves the `match()` and `search()` functions in the JsonPath component. These functions compile attacker-controlled filter patterns into regular expressions (regex) for use with `preg_match()` without imposing any length restrictions, regex complexity limits, or bounded backtracking controls.

This allows attackers to craft malicious regex patterns that cause catastrophic backtracking. When such patterns are processed, they can consume excessive CPU resources, leading to a denial-of-service (DoS) condition. For example, a pattern like `$[?search(@, "(a+)+$")]` can pin worker CPU for seconds per request, exhausting server resources with just a few concurrent requests.

The vulnerability is fixed in versions 7.4.12 and 8.0.12 by introducing a backtracking limit of 10,000 for regex operations, preventing excessive resource consumption.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires identifying whether your system is running an affected version of Symfony (7.3.0-BETA1 to 7.4.11 or 8.0.0 to 8.0.11) with the JsonPath component in use. Since the vulnerability is triggered by attacker-controlled JSONPath expressions passed to the `match()` or `search()` functions, you can check for its presence in the following ways:

• Check Symfony version: Run `composer show symfony/symfony` or `composer show symfony/jsonpath` to verify the installed version. If the version falls within the affected ranges, the system may be vulnerable.
• Review application code: Search for usage of `JsonPath` component functions like `match()` or `search()` in your codebase. Example command: `grep -r "match(" --include="*.php" /path/to/project` or `grep -r "search(" --include="*.php" /path/to/project`.
• Monitor for unusual CPU spikes: Since the vulnerability causes excessive CPU usage due to regex backtracking, monitor processes for unexpected high CPU consumption, especially in PHP worker processes handling JSONPath evaluations.
• Log and inspect JSONPath inputs: If your application logs input data, inspect logs for suspicious JSONPath patterns containing complex regex constructs (e.g., nested quantifiers like `(a+)+`).

There are no direct network-based detection methods for this vulnerability, as it is triggered by application-level input processing. Detection relies on version checks and code audits.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you in several ways if you are using an affected version of Symfony with the JsonPath component:

• Denial-of-Service (DoS): An attacker can send specially crafted JSONPath expressions to your application, causing excessive CPU usage. This can slow down or crash your server, making your application unavailable to legitimate users.
• Resource Exhaustion: Even a small number of malicious requests can exhaust worker pools, leading to degraded performance or complete service outages.
• Stealthy Exploitation: The vulnerability can be exploited without leaving obvious traces in logs because the `@` prefix in `preg_match()` suppresses backtrack-limit errors.
• Application-Specific Risk: The impact depends on whether your application evaluates attacker-influenced JSONPath expressions with `match()` or `search()` filters against non-trivial JSON input. If it does, your application is at risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can affect compliance with common standards and regulations in the following ways:

• GDPR (General Data Protection Regulation): If the denial-of-service (DoS) caused by this vulnerability leads to service unavailability, it could impact the availability of personal data, violating GDPR's requirement for ensuring the confidentiality, integrity, and availability of personal data (Article 32). Additionally, if the vulnerability is exploited to disrupt services handling personal data, it may trigger reporting obligations under GDPR's incident notification requirements (Article 33).
• HIPAA (Health Insurance Portability and Accountability Act): For organizations handling protected health information (PHI), a DoS attack exploiting this vulnerability could disrupt access to critical systems, violating HIPAA's Security Rule, which requires ensuring the availability of electronic PHI (ePHI). Prolonged downtime or service disruption may also be considered a reportable security incident under HIPAA's breach notification rules.
• Other Standards: The vulnerability may also impact compliance with standards like ISO 27001, which requires organizations to manage information security risks, including those related to system availability. Failure to address such vulnerabilities could result in non-compliance with controls related to operational security and incident management.

To maintain compliance, organizations should patch the vulnerability promptly and ensure their systems are resilient against DoS attacks.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate CVE-2026-45756, follow these immediate steps:

• Upgrade Symfony: Update to the patched versions 7.4.12 or 8.0.12 (or later). Use `composer require symfony/symfony:^7.4.12` or `composer require symfony/symfony:^8.0.12` to apply the fix. If using the standalone JsonPath component, update it similarly.
• Apply temporary workarounds if upgrading is not immediately possible: Limit the complexity of JSONPath expressions accepted by your application. For example, reject inputs containing regex patterns with nested quantifiers (e.g., `(a+)+`) or excessive repetition.
• Restrict input size: Enforce a maximum length for JSONPath expressions passed to `match()` or `search()` to reduce the risk of resource exhaustion.
• Monitor and rate-limit requests: Implement rate limiting on endpoints that process JSONPath expressions to prevent abuse. Monitor for unusual patterns in input data that could trigger excessive backtracking.
• Isolate affected services: If the application cannot be updated immediately, consider isolating it from untrusted input sources or deploying additional safeguards like web application firewalls (WAFs) to filter malicious JSONPath patterns.

The most effective mitigation is upgrading to the patched versions, as they introduce a hard-coded backtrack limit to prevent exploitation.

Useful 0 Not Useful 0