Threats tagged 'ghsa-2v3c-qxhr-7vpv'

Symfony's YAML parser had an unbounded recursion vulnerability in its inline lexer, allowing deeply nested inline collections in YAML documents to cause stack exhaustion and crash the process. This affects any code parsing untrusted YAML, including endpoints using #[MapRequestPayload] without restricting acceptFormat. The issue is fixed by bounding the nesting level and raising a ParseException when exceeded.