The Symfony framework's JsonPath component, in versions from 7.3.0-BETA1 until 7.4.12 and 8.0.12, compiles attacker-controlled match() and search() filter patterns directly into preg_match() without imposing length caps, i-regexp restrictions, or bounded backtracking. This allows crafted regular expressions to cause catastrophic backtracking, which can pin the worker CPU and lead to denial of service conditions. The vulnerability is resolved in versions 7.4.12 and 8.0.12. Multiple Ubuntu package versions of Symfony are affected as listed, and no known exploits in the wild have been reported.

An attacker can supply specially crafted JsonPath filter patterns that cause the preg_match() function to perform catastrophic backtracking, resulting in high CPU usage and denial of service on the affected system. This can disrupt availability of applications relying on the vulnerable Symfony JsonPath component. No other impacts such as privilege escalation or data disclosure are indicated.

This vulnerability is fixed in Symfony versions 7.4.12 and 8.0.12. Users should upgrade to these or later versions to remediate the issue. Since this is not a cloud service, patching the affected Symfony component in the application environment is required. Patch status is confirmed by the vendor advisory. No alternative mitigations are indicated.