8.7

CVE-2026-45305

Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser::cleanup() used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup, allowing crafted input to make parsing hang for an arbitrarily long time. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Sensiolabs ≫ Symfony Version < 5.4.52
Sensiolabs ≫ Symfony Version >= 6.0.0 < 6.4.40
Sensiolabs ≫ Symfony Version >= 7.0.0 < 7.4.12
Sensiolabs ≫ Symfony Version >= 8.0.0 < 8.0.12
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.8% 0.53
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
security-advisories@github.com 8.7 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-1333 Inefficient Regular Expression Complexity

The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

https://github.com/symfony/symfony/releases/tag/v5.4.52
Product
Release Notes
https://github.com/symfony/symfony/releases/tag/v6.4.40
Product
Release Notes
https://github.com/symfony/symfony/releases/tag/v7.4.12
Product
Release Notes
https://github.com/symfony/symfony/releases/tag/v8.0.12
Product
Release Notes
https://github.com/symfony/symfony/commit/9749cd43c5e09b3735093623670b21b9d8a056cb
Patch
https://github.com/symfony/symfony/security/advisories/GHSA-9frc-8383-795m
Patch
Vendor Advisory