CVE-2026-109413
Received Received - Intake

Stack Overflow in Symfony YAML Parser

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Checkmarx

Description
In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A document made of deeply nested inline collections, such as [[[[...]]]], exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error. Any code parsing untrusted YAML is affected. That includes #[MapRequestPayload] when the Yaml component is installed and the endpoint does not restrict acceptFormat: a single unauthenticated request with a YAML content type is enough. This issue affects symfony/yaml through v5.4.53, v6.0.0-BETA1 through v6.4.44, v7.0.0-BETA1 through v7.4.17, and v8.0.0-BETA1 through v8.1.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-109413
EUVD
EUVD-2026-102109

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
sensiolabs symfony 0
sensiolabs symfony v6.0.0-BETA1
sensiolabs symfony v7.0.0-BETA1
sensiolabs symfony v8.0.0-BETA1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unbounded recursion flaw in the Symfony YAML parser. The inline lexer processes deeply nested inline collections like [[[[...]]]] without tracking nesting depth. This exhausts the PHP stack, causing crashes or fatal errors during parsing of untrusted YAML input.

Detection Guidance

To detect this vulnerability, inspect Symfony applications using the YAML component for unpatched versions. Check installed Symfony versions via composer show symfony/yaml or review application logs for crashes during YAML parsing. Test with deeply nested inline collections like [[[[...]]]] to observe stack exhaustion or fatal errors.

Impact Analysis

It allows unauthenticated attackers to crash applications by sending a single malicious YAML request. This causes denial-of-service conditions, disrupting service availability. Systems parsing untrusted YAML, including Symfony apps using #[MapRequestPayload], are particularly vulnerable.

Mitigation Strategies

Immediately update the Symfony YAML component to versions 5.4.54, 6.4.45, 7.4.18, or 8.1.6 or later. If updating is not possible, restrict YAML input parsing or disable #[MapRequestPayload] endpoints accepting YAML content types. Monitor for crashes or fatal errors during YAML parsing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109413. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart