Symfony, a PHP framework, had a vulnerability in its Component\Yaml\Parser where YAML collection aliases were resolved recursively without limits. This flaw allowed crafted YAML inputs to expand exponentially in memory usage, potentially exhausting system memory. The vulnerability affects multiple Symfony versions prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12. The issue is addressed by updates in these versions that prevent such recursive expansion.

An attacker can supply a small malicious YAML input that causes the parser to consume excessive memory by recursively resolving aliases, potentially leading to denial of service due to resource exhaustion. There is no indication of code execution or data leakage from the provided data.

A fix is available in Symfony versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12. Users should upgrade to these or later versions to remediate the vulnerability. No vendor advisory contradicts this; therefore, upgrading is the recommended mitigation.