CVE-2026-109413: CWE-674 Uncontrolled Recursion in sensiolabs symfony
Description
In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A document made of deeply nested inline collections, such as [[[[...]]]], exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error. Any code parsing untrusted YAML is affected. That includes #[MapRequestPayload] when the Yaml component is installed and the endpoint does not restrict acceptFormat: a single unauthenticated request with a YAML content type is enough. This issue affects symfony/yaml through v5.4.53, v6.0.0-BETA1 through v6.4.44, v7.0.0-BETA1 through v7.4.17, and v8.0.0-BETA1 through v8.1.5.
CVSS v4.0
Score 8.7high
Affected software
sensiolabs
symfony
pkg:composer/symfony/yamlRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-109413 is a vulnerability in the Symfony YAML parser where the lexInlineStructure() method recursively calls lexInlineMapping() and lexInlineSequence() for every '{' and '[' character in an inline collection without respecting the maxNestingLevel limit. This uncontrolled recursion leads to stack exhaustion when parsing deeply nested inline YAML collections, causing process crashes or fatal errors depending on PHP stack settings. The vulnerability affects symfony/yaml versions prior to 5.4.54, 6.4.45, 7.4.18, and 8.1.6. Unauthenticated attackers can trigger this by sending a single YAML payload to endpoints that accept YAML without proper format restrictions.
Potential Impact
An attacker can cause denial of service by sending a specially crafted deeply nested YAML document to vulnerable Symfony applications. This results in stack exhaustion and crashes or fatal errors in the PHP process handling the request. The vulnerability does not require authentication and can be triggered remotely, impacting availability.
Mitigation Recommendations
Upgrading to Symfony YAML versions 5.4.54, 6.4.45, 7.4.18, or 8.1.6 or later resolves this issue. Until patched, restrict endpoints from accepting YAML content types or validate and limit YAML input nesting depth to prevent exploitation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Checkmarx
- Date Reserved
- 2026-10-12T15:28:55.069Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad0eb702cdf04f6563e7c4e
Added to database: 10/15/2026, 15:04:16 UTC
Last enriched: 10/15/2026, 15:18:20 UTC
Last updated: 10/15/2026, 19:00:26 UTC
Views: 16
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.