Threat database

CVE-2026-109449 is a high-severity vulnerability in the Symfony ExpressionLanguage component affecting versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9. The parser does not limit the depth of its node tree, allowing expressions with extremely deep nesting to cause uncontrolled recursion. This can crash the PHP process when freeing the node tree. Applications that validate user-supplied expressions using #[Assert\ExpressionSyntax] or parse untrusted expressions are vulnerable to denial-of-service via a single crafted request.

CVE-2026-109413 is a high-severity vulnerability in the Symfony YAML component affecting versions prior to 5.4.54, 6.4.45, 7.4.18, and 8.1.6. The issue arises from uncontrolled recursion in the YAML parser's lexInlineStructure function, which does not properly limit nesting levels for inline collections. This can cause stack exhaustion and crash the process or cause a fatal error when parsing deeply nested YAML input. Any code parsing untrusted YAML is vulnerable, including endpoints using #[MapRequestPayload] without restricting the accepted format. The vulnerability is exploitable without authentication by sending a crafted YAML payload.

CVE-2026-108082 is a high-severity vulnerability in the Symfony PHP framework affecting multiple versions prior to 5.4.54, 6.4.46, 7.4.19, and 8.1.7. The issue arises from inefficient regular expression complexity in HeaderUtils::split(), which processes HTTP header values. This can cause exponential backtracking when parsing headers with runs of whitespace before separators, leading to high CPU usage and denial of service. The vulnerability is reachable without authentication via crafted HTTP requests. From 18 spaces onward, the regex engine hits backtrack limits, causing header directives to be silently dropped.