CVE-2026-49209

Analyzed Analyzed - Analysis Complete

Denial of Service in Symfony UX LiveComponent

Publication date: 2026-07-17

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description

Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke() iterates over the client-supplied actions array and issues a full HttpKernel sub-request for each entry; because the array size is never bounded, an authenticated client can submit a single _batch request containing thousands of actions and exhaust CPU, memory, and database connections on the application server. This issue is fixed in versions 2.36.0 and 3.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-17

Last Modified

2026-07-20

Generated

2026-08-07

AI Q&A

2026-07-17

EPSS Evaluated

2026-08-05

NVD

CVE-2026-49209

EUVD

EUVD-2026-45208

Affected Vendors & Products

Vendor	Product	Version / Range
symfony	ux	3.0.0
symfony	ux	From 2.5.0 (inc) to 2.36.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial of service issue in Symfony UX LiveComponent. The BatchActionController::__invoke() method processes client-supplied actions in a batch request without limiting the number of actions. An authenticated attacker can submit a single batch request with thousands of actions, causing the server to exhaust CPU, memory, and database connections by creating excessive HttpKernel sub-requests.

Detection Guidance

Monitor for unusually high CPU, memory, or database connection usage during batch requests. Check server logs for excessive HttpKernel sub-requests or BadRequestHttpException errors indicating batch size limits being exceeded.

Impact Analysis

If exploited, this vulnerability can lead to server resource exhaustion, causing slowdowns, crashes, or downtime for applications using affected Symfony UX LiveComponent versions. It may disrupt services for legitimate users and require manual intervention to restore normal operation.

Compliance Impact

This vulnerability could impact compliance by causing service disruptions that violate availability requirements in GDPR or HIPAA. Downtime may lead to unauthorized access risks or failure to meet data processing timelines, potentially resulting in regulatory penalties or breaches of service-level agreements.

Mitigation Strategies

Upgrade Symfony UX LiveComponent to version 2.36.0 or 3.1.0 or later to enforce the 50-action limit per batch request. If immediate upgrade is not possible, implement network-level rate limiting or WAF rules to block large batch requests.

Hi! I’m here to help you understand CVE-2026-49209. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70