CVE-2026-109449
Received Received - Intake

Stack Overflow in Symfony ExpressionLanguage Parser

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Checkmarx

Description
In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed. #[Assert\ExpressionSyntax] passes the validated value to ExpressionLanguage::lint(), so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions. This issue affects symfony/expression-language through v5.4.53, v6.0.0-BETA1 through v6.4.47, v7.0.0-BETA1 through v7.4.20, and v8.0.0-BETA1 through v8.1.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-109449
EUVD
EUVD-2026-102134

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
sensiolabs symfony 0
sensiolabs symfony v6.0.0-BETA1
sensiolabs symfony v7.0.0-BETA1
sensiolabs symfony v8.0.0-BETA1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a denial-of-service issue in Symfony's ExpressionLanguage component. The parser allowed unbounded nesting of expressions, such as tens of thousands of nested operators or array literals. When parsing such deeply nested structures, the PHP process crashed during memory cleanup rather than during parsing itself.

Detection Guidance

To detect this vulnerability, check the installed version of Symfony ExpressionLanguage. Run: composer show symfony/expression-language. If the version is below 5.4.54, 6.4.48, 7.4.21, or 8.1.9, the system is vulnerable.

Impact Analysis

An attacker could exploit this by submitting a single request containing a deeply nested expression. This would crash the PHP process, causing a denial of service. Applications validating user-written expressions are particularly vulnerable, as a single malicious request could disrupt service.

Mitigation Strategies

Upgrade Symfony ExpressionLanguage to the latest patched version (5.4.54+, 6.4.48+, 7.4.21+, or 8.1.9+). If upgrading is not possible, apply the depth limit patch manually or restrict user input to trusted expressions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109449. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart