{"id":"CVE-2026-45305","aliases":["CLSA-2026-1784077476","CLSA-2026-1784077477","CLSA-2026-1784250519","DEBIAN-CVE-2026-45305","EUVD-2026-44359","GHSA-9frc-8383-795m","UBUNTU-CVE-2026-45305"],"status":"published","title":"Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex","description":"Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\\Component\\Yaml\\Parser::cleanup() used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup, allowing crafted input to make parsing hang for an arbitrarily long time. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00684,"percentile":0.5289,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333"],"published":"2026-05-27T21:34:35Z","modified":"2026-10-28T02:30:46Z","fixes":[{"ecosystem":"Packagist","package":"symfony/yaml","fixed_in":["5.4.52","6.4.40","7.4.12","8.0.12"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"symfony/symfony","fixed_in":["5.4.52","6.4.40","7.4.12","8.0.12"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Packagist","package":"symfony/yaml","fixed_in":["v2.8.52-p1+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"symfony","fixed_in":["5.4.53+dfsg-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"symfony","fixed_in":["6.4.41+dfsg-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"symfony","fixed_in":["7.4.12+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"symfony/yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.52"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.52"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.4.40"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.4.12"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.12"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"symfony/yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.4.40"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"symfony/yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.4.12"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"symfony/yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.12"}]}]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"symfony/yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"v4.4.45"},{"fixed":"v4.4.45-p1+tuxcare"}]}],"versions":["v4.4.45"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"symfony/yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"v3.4.47"},{"fixed":"v3.4.47-p1+tuxcare"}]}],"versions":["v3.4.47"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"symfony/yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"v2.8.52"},{"fixed":"v2.8.52-p1+tuxcare"}]}],"versions":["v2.8.52"]},{"source":"osv","ecosystem":"Debian:12","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.53+dfsg-0+deb12u1"}]}],"versions":["5.4.23+dfsg-1","5.4.23+dfsg-1+deb12u1","5.4.23+dfsg-1+deb12u2","5.4.23+dfsg-1+deb12u3","5.4.23+dfsg-1+deb12u4","5.4.23+dfsg-1+deb12u5","5.4.24+dfsg-1","5.4.25+dfsg-1","5.4.27+dfsg-1","5.4.28+dfsg-1","5.4.29+dfsg-1","5.4.30+dfsg-1","5.4.31+dfsg-1","5.4.31+dfsg-2","5.4.32+dfsg-1","5.4.33+dfsg-1","5.4.34+dfsg-1","5.4.34+dfsg-2","5.4.35+dfsg-1","5.4.35+dfsg-2","5.4.35+dfsg-3","5.4.52+dfsg-0+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.41+dfsg-0+deb13u1"}]}],"versions":["6.4.21+dfsg-2","6.4.21+dfsg-2+deb13u1","6.4.24+dfsg-1","6.4.25+dfsg-1","6.4.40+dfsg-0+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.12+dfsg-1"}]}],"versions":["6.4.21+dfsg-2","6.4.24+dfsg-1","6.4.25+dfsg-1","7.0.4+dfsg-1","7.0.5+dfsg-1","7.0.6+dfsg-1","7.0.7+dfsg-1","7.1.0~beta1+dfsg-1","7.1.0~rc1+dfsg-1","7.1.2+dfsg-1","7.1.3+dfsg-1","7.1.4+dfsg-1","7.1.5+dfsg-1","7.2.0~beta1+dfsg-1","7.2.0~beta2+dfsg-1","7.2.0~rc1+dfsg-1","7.2.1+dfsg-1","7.2.2+dfsg-1","7.2.3+dfsg-1","7.2.4+dfsg-1","7.2.5+dfsg-1","7.2.6-1","7.3.0+dfsg-1","7.3.0~beta1+dfsg-1","7.3.0~beta2+dfsg-1","7.3.0~rc1+dfsg-1","7.3.1+dfsg-1","7.3.2+dfsg-1","7.3.3+dfsg-1","7.3.4+dfsg-1","7.3.5-1","7.4.0+dfsg-1","7.4.0+dfsg-2","7.4.0~beta1-1","7.4.0~beta1-2","7.4.0~beta2+dfsg-1","7.4.0~beta2+dfsg-2","7.4.0~beta2+dfsg-3","7.4.0~rc1+dfsg-1","7.4.0~rc2+dfsg-1","7.4.0~rc3+dfsg-1","7.4.10+dfsg-1","7.4.2+dfsg-1","7.4.2+dfsg-2","7.4.3+dfsg-1","7.4.4+dfsg-1","7.4.5+dfsg-1","7.4.6+dfsg-1","7.4.6+dfsg-2","7.4.7+dfsg-1","7.4.8+dfsg-1","7.4.9+dfsg-1"]},{"source":"osv","ecosystem":"Packagist","package":"symfony/yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.52"}]}],"versions":["2.0.4","2.0.5","2.0.6","2.0.7","v2.0.10","v2.0.12","v2.0.13","v2.0.14","v2.0.15","v2.0.16","v2.0.17","v2.0.18","v2.0.19","v2.0.20","v2.0.21","v2.0.22","v2.0.23","v2.0.24","v2.0.25","v2.0.9","v2.1.0","v2.1.1","v2.1.10","v2.1.11","v2.1.12","v2.1.13","v2.1.2","v2.1.3","v2.1.4","v2.1.5","v2.1.6","v2.1.7","v2.1.8","v2.1.9","v2.2.0","v2.2.1","v2.2.10","v2.2.11","v2.2.2","v2.2.3","v2.2.4","v2.2.5","v2.2.6","v2.2.7","v2.2.8","v2.2.9","v2.3.0","v2.3.1","v2.3.10","v2.3.11","v2.3.12","v2.3.13","v2.3.14","v2.3.15","v2.3.16","v2.3.17","v2.3.18","v2.3.19","v2.3.2","v2.3.20","v2.3.21","v2.3.22","v2.3.23","v2.3.24","v2.3.25","v2.3.26","v2.3.27","v2.3.28","v2.3.29","v2.3.3","v2.3.30","v2.3.31","v2.3.32","v2.3.33","v2.3.34","v2.3.35","v2.3.36","v2.3.37","v2.3.38","v2.3.39","v2.3.4","v2.3.40","v2.3.41","v2.3.42","v2.3.5","v2.3.6","v2.3.7","v2.3.8","v2.3.9","v2.4.0","v2.4.0-BETA1","v2.4.0-BETA2","v2.4.0-RC1","v2.4.1","v2.4.10","v2.4.2","v2.4.3","v2.4.4","v2.4.5","v2.4.6","v2.4.7","v2.4.8","v2.4.9","v2.5.0","v2.5.0-BETA1","v2.5.0-BETA2","v2.5.0-RC1","v2.5.1","v2.5.10","v2.5.11","v2.5.12","v2.5.2","v2.5.3","v2.5.4","v2.5.5","v2.5.6","v2.5.7","v2.5.8","v2.5.9","v2.6.0","v2.6.0-BETA1","v2.6.0-BETA2","v2.6.1","v2.6.10","v2.6.11","v2.6.12","v2.6.13","v2.6.2","v2.6.3","v2.6.4","v2.6.5","v2.6.6","v2.6.7","v2.6.8","v2.6.9","v2.7.0","v2.7.0-BETA1","v2.7.0-BETA2","v2.7.1","v2.7.10","v2.7.11","v2.7.12","v2.7.13","v2.7.14","v2.7.15","v2.7.16","v2.7.17","v2.7.18","v2.7.19","v2.7.2","v2.7.20","v2.7.21","v2.7.22","v2.7.23","v2.7.24","v2.7.25","v2.7.26","v2.7.27","v2.7.28","v2.7.29","v2.7.3","v2.7.30","v2.7.31","v2.7.32","v2.7.33","v2.7.34","v2.7.35","v2.7.36","v2.7.37","v2.7.38","v2.7.39","v2.7.4","v2.7.40","v2.7.41","v2.7.42","v2.7.43","v2.7.44","v2.7.45","v2.7.46","v2.7.47","v2.7.48","v2.7.49","v2.7.5","v2.7.50","v2.7.51","v2.7.6","v2.7.7","v2.7.8","v2.7.9","v2.8.0","v2.8.0-BETA1","v2.8.1","v2.8.10","v2.8.11","v2.8.12","v2.8.13","v2.8.14","v2.8.15","v2.8.16","v2.8.17","v2.8.18","v2.8.19","v2.8.2","v2.8.20","v2.8.21","v2.8.22","v2.8.23","v2.8.24","v2.8.25","v2.8.26","v2.8.27","v2.8.28","v2.8.29","v2.8.3","v2.8.30","v2.8.31","v2.8.32","v2.8.33","v2.8.34","v2.8.35","v2.8.36","v2.8.37","v2.8.38","v2.8.39","v2.8.4","v2.8.40","v2.8.41","v2.8.42","v2.8.43","v2.8.44","v2.8.45","v2.8.46","v2.8.47","v2.8.48","v2.8.49","v2.8.5","v2.8.50","v2.8.52","v2.8.6","v2.8.7","v2.8.8","v2.8.9","v3.0.0","v3.0.0-BETA1","v3.0.1","v3.0.2","v3.0.3","v3.0.4","v3.0.5","v3.0.6","v3.0.7","v3.0.8","v3.0.9","v3.1.0","v3.1.0-BETA1","v3.1.0-RC1","v3.1.1","v3.1.10","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.1.6","v3.1.7","v3.1.8","v3.1.9","v3.2.0","v3.2.0-BETA1","v3.2.0-RC1","v3.2.0-RC2","v3.2.1","v3.2.10","v3.2.11","v3.2.12","v3.2.13","v3.2.14","v3.2.2","v3.2.3","v3.2.4","v3.2.5","v3.2.6","v3.2.7","v3.2.8","v3.2.9","v3.3.0","v3.3.0-BETA1","v3.3.0-RC1","v3.3.1","v3.3.10","v3.3.11","v3.3.12","v3.3.13","v3.3.14","v3.3.15","v3.3.16","v3.3.17","v3.3.18","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.3.6","v3.3.7","v3.3.8","v3.3.9","v3.4.0","v3.4.0-BETA1","v3.4.0-BETA2","v3.4.0-BETA3","v3.4.0-BETA4","v3.4.0-RC1","v3.4.0-RC2","v3.4.1","v3.4.10","v3.4.11","v3.4.12","v3.4.13","v3.4.14","v3.4.15","v3.4.16","v3.4.17","v3.4.18","v3.4.19","v3.4.2","v3.4.20","v3.4.21","v3.4.22","v3.4.23","v3.4.24","v3.4.25","v3.4.26","v3.4.27","v3.4.28","v3.4.29","v3.4.3","v3.4.30","v3.4.31","v3.4.32","v3.4.33","v3.4.34","v3.4.35","v3.4.36","v3.4.37","v3.4.38","v3.4.39","v3.4.4","v3.4.40","v3.4.41","v3.4.42","v3.4.43","v3.4.44","v3.4.45","v3.4.46","v3.4.47","v3.4.5","v3.4.6","v3.4.7","v3.4.8","v3.4.9","v4.0.0","v4.0.0-BETA1","v4.0.0-BETA2","v4.0.0-BETA3","v4.0.0-BETA4","v4.0.0-RC1","v4.0.0-RC2","v4.0.1","v4.0.10","v4.0.11","v4.0.12","v4.0.13","v4.0.14","v4.0.15","v4.0.2","v4.0.3","v4.0.4","v4.0.5","v4.0.6","v4.0.7","v4.0.8","v4.0.9","v4.1.0","v4.1.0-BETA1","v4.1.0-BETA2","v4.1.0-BETA3","v4.1.1","v4.1.10","v4.1.11","v4.1.12","v4.1.2","v4.1.3","v4.1.4","v4.1.5","v4.1.6","v4.1.7","v4.1.8","v4.1.9","v4.2.0","v4.2.0-BETA1","v4.2.0-BETA2","v4.2.0-RC1","v4.2.1","v4.2.10","v4.2.11","v4.2.12","v4.2.2","v4.2.3","v4.2.4","v4.2.5","v4.2.6","v4.2.7","v4.2.8","v4.2.9","v4.3.0","v4.3.0-BETA1","v4.3.0-BETA2","v4.3.0-RC1","v4.3.1","v4.3.10","v4.3.11","v4.3.2","v4.3.3","v4.3.4","v4.3.5","v4.3.6","v4.3.7","v4.3.8","v4.3.9","v4.4.0","v4.4.0-BETA1","v4.4.0-BETA2","v4.4.0-RC1","v4.4.1","v4.4.10","v4.4.11","v4.4.12","v4.4.13","v4.4.14","v4.4.15","v4.4.16","v4.4.17","v4.4.18","v4.4.19","v4.4.2","v4.4.20","v4.4.21","v4.4.22","v4.4.24","v4.4.25","v4.4.26","v4.4.27","v4.4.29","v4.4.3","v4.4.34","v4.4.36","v4.4.37","v4.4.4","v4.4.43","v4.4.44","v4.4.45","v4.4.5","v4.4.6","v4.4.7","v4.4.8","v4.4.9","v5.0.0","v5.0.0-BETA1","v5.0.0-BETA2","v5.0.0-RC1","v5.0.1","v5.0.10","v5.0.11","v5.0.2","v5.0.3","v5.0.4","v5.0.5","v5.0.6","v5.0.7","v5.0.8","v5.0.9","v5.1.0","v5.1.0-BETA1","v5.1.0-RC1","v5.1.0-RC2","v5.1.1","v5.1.10","v5.1.11","v5.1.2","v5.1.3","v5.1.4","v5.1.5","v5.1.6","v5.1.7","v5.1.8","v5.1.9","v5.2.0","v5.2.0-BETA1","v5.2.0-BETA2","v5.2.0-BETA3","v5.2.0-RC1","v5.2.0-RC2","v5.2.1","v5.2.10","v5.2.11","v5.2.12","v5.2.14","v5.2.2","v5.2.3","v5.2.4","v5.2.5","v5.2.7","v5.2.9","v5.3.0","v5.3.0-BETA1","v5.3.0-BETA2","v5.3.0-RC1","v5.3.11","v5.3.13","v5.3.14","v5.3.2","v5.3.3","v5.3.4","v5.3.6","v5.4.0","v5.4.0-BETA1","v5.4.0-BETA2","v5.4.0-RC1","v5.4.10","v5.4.11","v5.4.12","v5.4.14","v5.4.16","v5.4.17","v5.4.19","v5.4.2","v5.4.21","v5.4.23","v5.4.3","v5.4.30","v5.4.31","v5.4.35","v5.4.39","v5.4.40","v5.4.43","v5.4.44","v5.4.45"]},{"source":"osv","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.52"}]}],"versions":["2.0.4","2.0.5","2.0.6","2.0.7","v2.0.10","v2.0.11","v2.0.12","v2.0.13","v2.0.14","v2.0.15","v2.0.16","v2.0.17","v2.0.18","v2.0.19","v2.0.20","v2.0.21","v2.0.22","v2.0.23","v2.0.24","v2.0.25","v2.0.9","v2.1.0","v2.1.0-BETA1","v2.1.0-BETA2","v2.1.0-BETA3","v2.1.0-BETA4","v2.1.0-RC1","v2.1.0-RC2","v2.1.1","v2.1.10","v2.1.11","v2.1.12","v2.1.13","v2.1.2","v2.1.3","v2.1.4","v2.1.5","v2.1.6","v2.1.7","v2.1.8","v2.1.9","v2.2.0","v2.2.0-BETA1","v2.2.0-BETA2","v2.2.0-RC1","v2.2.0-RC2","v2.2.0-RC3","v2.2.1","v2.2.10","v2.2.11","v2.2.2","v2.2.3","v2.2.4","v2.2.5","v2.2.6","v2.2.7","v2.2.8","v2.2.9","v2.3.0","v2.3.0-BETA1","v2.3.0-BETA2","v2.3.0-RC1","v2.3.1","v2.3.10","v2.3.11","v2.3.12","v2.3.13","v2.3.14","v2.3.15","v2.3.16","v2.3.17","v2.3.18","v2.3.19","v2.3.2","v2.3.20","v2.3.21","v2.3.22","v2.3.23","v2.3.24","v2.3.25","v2.3.26","v2.3.27","v2.3.28","v2.3.29","v2.3.3","v2.3.30","v2.3.31","v2.3.32","v2.3.33","v2.3.34","v2.3.35","v2.3.36","v2.3.37","v2.3.38","v2.3.39","v2.3.4","v2.3.40","v2.3.41","v2.3.42","v2.3.5","v2.3.6","v2.3.7","v2.3.8","v2.3.9","v2.4.0","v2.4.0-BETA1","v2.4.0-BETA2","v2.4.0-RC1","v2.4.1","v2.4.10","v2.4.2","v2.4.3","v2.4.4","v2.4.5","v2.4.6","v2.4.7","v2.4.8","v2.4.9","v2.5.0","v2.5.0-BETA1","v2.5.0-BETA2","v2.5.0-RC1","v2.5.1","v2.5.10","v2.5.11","v2.5.12","v2.5.2","v2.5.3","v2.5.4","v2.5.5","v2.5.6","v2.5.7","v2.5.8","v2.5.9","v2.6.0","v2.6.0-BETA1","v2.6.0-BETA2","v2.6.1","v2.6.10","v2.6.11","v2.6.12","v2.6.13","v2.6.2","v2.6.3","v2.6.4","v2.6.5","v2.6.6","v2.6.7","v2.6.8","v2.6.9","v2.7.0","v2.7.0-BETA1","v2.7.0-BETA2","v2.7.1","v2.7.10","v2.7.11","v2.7.12","v2.7.13","v2.7.14","v2.7.15","v2.7.16","v2.7.17","v2.7.18","v2.7.19","v2.7.2","v2.7.20","v2.7.21","v2.7.22","v2.7.23","v2.7.24","v2.7.25","v2.7.26","v2.7.27","v2.7.28","v2.7.29","v2.7.3","v2.7.30","v2.7.31","v2.7.32","v2.7.33","v2.7.34","v2.7.35","v2.7.36","v2.7.37","v2.7.38","v2.7.39","v2.7.4","v2.7.40","v2.7.41","v2.7.42","v2.7.43","v2.7.44","v2.7.45","v2.7.46","v2.7.47","v2.7.48","v2.7.49","v2.7.5","v2.7.50","v2.7.51","v2.7.52","v2.7.6","v2.7.7","v2.7.8","v2.7.9","v2.8.0","v2.8.0-BETA1","v2.8.1","v2.8.10","v2.8.11","v2.8.12","v2.8.13","v2.8.14","v2.8.15","v2.8.16","v2.8.17","v2.8.18","v2.8.19","v2.8.2","v2.8.20","v2.8.21","v2.8.22","v2.8.23","v2.8.24","v2.8.25","v2.8.26","v2.8.27","v2.8.28","v2.8.29","v2.8.3","v2.8.30","v2.8.31","v2.8.32","v2.8.33","v2.8.34","v2.8.35","v2.8.36","v2.8.37","v2.8.38","v2.8.39","v2.8.4","v2.8.40","v2.8.41","v2.8.42","v2.8.43","v2.8.44","v2.8.45","v2.8.46","v2.8.47","v2.8.48","v2.8.49","v2.8.5","v2.8.50","v2.8.51","v2.8.52","v2.8.6","v2.8.7","v2.8.8","v2.8.9","v3.0.0","v3.0.0-BETA1","v3.0.1","v3.0.2","v3.0.3","v3.0.4","v3.0.5","v3.0.6","v3.0.7","v3.0.8","v3.0.9","v3.1.0","v3.1.0-BETA1","v3.1.0-RC1","v3.1.1","v3.1.10","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.1.6","v3.1.7","v3.1.8","v3.1.9","v3.2.0","v3.2.0-BETA1","v3.2.0-RC1","v3.2.0-RC2","v3.2.1","v3.2.10","v3.2.11","v3.2.12","v3.2.13","v3.2.14","v3.2.2","v3.2.3","v3.2.4","v3.2.5","v3.2.6","v3.2.7","v3.2.8","v3.2.9","v3.3.0","v3.3.0-BETA1","v3.3.0-RC1","v3.3.1","v3.3.10","v3.3.11","v3.3.12","v3.3.13","v3.3.14","v3.3.15","v3.3.16","v3.3.17","v3.3.18","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.3.6","v3.3.7","v3.3.8","v3.3.9","v3.4.0","v3.4.0-BETA1","v3.4.0-BETA2","v3.4.0-BETA3","v3.4.0-BETA4","v3.4.0-RC1","v3.4.0-RC2","v3.4.1","v3.4.10","v3.4.11","v3.4.12","v3.4.13","v3.4.14","v3.4.15","v3.4.16","v3.4.17","v3.4.18","v3.4.19","v3.4.2","v3.4.20","v3.4.21","v3.4.22","v3.4.23","v3.4.24","v3.4.25","v3.4.26","v3.4.27","v3.4.28","v3.4.29","v3.4.3","v3.4.30","v3.4.31","v3.4.32","v3.4.33","v3.4.34","v3.4.35","v3.4.36","v3.4.37","v3.4.38","v3.4.39","v3.4.4","v3.4.40","v3.4.41","v3.4.42","v3.4.43","v3.4.44","v3.4.45","v3.4.46","v3.4.47","v3.4.48","v3.4.49","v3.4.5","v3.4.6","v3.4.7","v3.4.8","v3.4.9","v4.0.0","v4.0.0-BETA1","v4.0.0-BETA2","v4.0.0-BETA3","v4.0.0-BETA4","v4.0.0-RC1","v4.0.0-RC2","v4.0.1","v4.0.10","v4.0.11","v4.0.12","v4.0.13","v4.0.14","v4.0.15","v4.0.2","v4.0.3","v4.0.4","v4.0.5","v4.0.6","v4.0.7","v4.0.8","v4.0.9","v4.1.0","v4.1.0-BETA1","v4.1.0-BETA2","v4.1.0-BETA3","v4.1.1","v4.1.10","v4.1.11","v4.1.12","v4.1.13","v4.1.2","v4.1.3","v4.1.4","v4.1.5","v4.1.6","v4.1.7","v4.1.8","v4.1.9","v4.2.0","v4.2.0-BETA1","v4.2.0-BETA2","v4.2.0-RC1","v4.2.1","v4.2.10","v4.2.11","v4.2.12","v4.2.2","v4.2.3","v4.2.4","v4.2.5","v4.2.6","v4.2.7","v4.2.8","v4.2.9","v4.3.0","v4.3.0-BETA1","v4.3.0-BETA2","v4.3.0-RC1","v4.3.1","v4.3.10","v4.3.11","v4.3.2","v4.3.3","v4.3.4","v4.3.5","v4.3.6","v4.3.7","v4.3.8","v4.3.9","v4.4.0","v4.4.0-BETA1","v4.4.0-BETA2","v4.4.0-RC1","v4.4.1","v4.4.10","v4.4.11","v4.4.12","v4.4.13","v4.4.14","v4.4.15","v4.4.16","v4.4.17","v4.4.18","v4.4.19","v4.4.2","v4.4.20","v4.4.21","v4.4.22","v4.4.23","v4.4.24","v4.4.25","v4.4.26","v4.4.27","v4.4.28","v4.4.29","v4.4.3","v4.4.30","v4.4.31","v4.4.32","v4.4.33","v4.4.34","v4.4.35","v4.4.36","v4.4.37","v4.4.38","v4.4.39","v4.4.4","v4.4.40","v4.4.41","v4.4.42","v4.4.43","v4.4.44","v4.4.45","v4.4.46","v4.4.47","v4.4.48","v4.4.49","v4.4.5","v4.4.50","v4.4.51","v4.4.6","v4.4.7","v4.4.8","v4.4.9","v5.0.0","v5.0.0-BETA1","v5.0.0-BETA2","v5.0.0-RC1","v5.0.1","v5.0.10","v5.0.11","v5.0.2","v5.0.3","v5.0.4","v5.0.5","v5.0.6","v5.0.7","v5.0.8","v5.0.9","v5.1.0","v5.1.0-BETA1","v5.1.0-RC1","v5.1.0-RC2","v5.1.1","v5.1.10","v5.1.11","v5.1.2","v5.1.3","v5.1.4","v5.1.5","v5.1.6","v5.1.7","v5.1.8","v5.1.9","v5.2.0","v5.2.0-BETA1","v5.2.0-BETA2","v5.2.0-BETA3","v5.2.0-RC1","v5.2.0-RC2","v5.2.1","v5.2.10","v5.2.11","v5.2.12","v5.2.13","v5.2.14","v5.2.2","v5.2.3","v5.2.4","v5.2.5","v5.2.6","v5.2.7","v5.2.8","v5.2.9","v5.3.0","v5.3.0-BETA1","v5.3.0-BETA2","v5.3.0-BETA3","v5.3.0-BETA4","v5.3.0-RC1","v5.3.1","v5.3.10","v5.3.11","v5.3.12","v5.3.13","v5.3.14","v5.3.15","v5.3.16","v5.3.2","v5.3.3","v5.3.4","v5.3.5","v5.3.6","v5.3.7","v5.3.8","v5.3.9","v5.4.0","v5.4.0-BETA1","v5.4.0-BETA2","v5.4.0-BETA3","v5.4.0-RC1","v5.4.1","v5.4.10","v5.4.11","v5.4.12","v5.4.13","v5.4.14","v5.4.15","v5.4.16","v5.4.17","v5.4.18","v5.4.19","v5.4.2","v5.4.20","v5.4.21","v5.4.22","v5.4.23","v5.4.24","v5.4.25","v5.4.26","v5.4.27","v5.4.28","v5.4.29","v5.4.3","v5.4.30","v5.4.31","v5.4.32","v5.4.33","v5.4.34","v5.4.35","v5.4.36","v5.4.37","v5.4.38","v5.4.39","v5.4.4","v5.4.40","v5.4.41","v5.4.42","v5.4.43","v5.4.44","v5.4.45","v5.4.46","v5.4.47","v5.4.48","v5.4.49","v5.4.5","v5.4.50","v5.4.51","v5.4.6","v5.4.7","v5.4.8","v5.4.9"]},{"source":"osv","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.4.40"}]}],"versions":["v6.0.0","v6.0.1","v6.0.10","v6.0.11","v6.0.12","v6.0.13","v6.0.14","v6.0.15","v6.0.16","v6.0.17","v6.0.18","v6.0.19","v6.0.2","v6.0.20","v6.0.3","v6.0.4","v6.0.5","v6.0.6","v6.0.7","v6.0.8","v6.0.9","v6.1.0","v6.1.0-BETA1","v6.1.0-BETA2","v6.1.0-RC1","v6.1.1","v6.1.10","v6.1.11","v6.1.12","v6.1.2","v6.1.3","v6.1.4","v6.1.5","v6.1.6","v6.1.7","v6.1.8","v6.1.9","v6.2.0","v6.2.0-BETA1","v6.2.0-BETA2","v6.2.0-BETA3","v6.2.0-RC1","v6.2.0-RC2","v6.2.1","v6.2.10","v6.2.11","v6.2.12","v6.2.13","v6.2.14","v6.2.2","v6.2.3","v6.2.4","v6.2.5","v6.2.6","v6.2.7","v6.2.8","v6.2.9","v6.3.0","v6.3.0-BETA1","v6.3.0-BETA2","v6.3.0-BETA3","v6.3.0-RC1","v6.3.0-RC2","v6.3.1","v6.3.10","v6.3.11","v6.3.12","v6.3.2","v6.3.3","v6.3.4","v6.3.5","v6.3.6","v6.3.7","v6.3.8","v6.3.9","v6.4.0","v6.4.0-BETA1","v6.4.0-BETA2","v6.4.0-BETA3","v6.4.0-RC1","v6.4.0-RC2","v6.4.1","v6.4.10","v6.4.11","v6.4.12","v6.4.13","v6.4.14","v6.4.15","v6.4.16","v6.4.17","v6.4.18","v6.4.19","v6.4.2","v6.4.20","v6.4.21","v6.4.22","v6.4.23","v6.4.24","v6.4.25","v6.4.26","v6.4.27","v6.4.28","v6.4.29","v6.4.3","v6.4.30","v6.4.31","v6.4.32","v6.4.33","v6.4.34","v6.4.35","v6.4.36","v6.4.37","v6.4.38","v6.4.39","v6.4.4","v6.4.5","v6.4.6","v6.4.7","v6.4.8","v6.4.9"]},{"source":"osv","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.4.12"}]}],"versions":["v7.0.0","v7.0.1","v7.0.10","v7.0.2","v7.0.3","v7.0.4","v7.0.5","v7.0.6","v7.0.7","v7.0.8","v7.0.9","v7.1.0","v7.1.0-BETA1","v7.1.0-RC1","v7.1.1","v7.1.10","v7.1.11","v7.1.2","v7.1.3","v7.1.4","v7.1.5","v7.1.6","v7.1.7","v7.1.8","v7.1.9","v7.2.0","v7.2.0-BETA1","v7.2.0-BETA2","v7.2.0-RC1","v7.2.1","v7.2.2","v7.2.3","v7.2.4","v7.2.5","v7.2.6","v7.2.7","v7.2.8","v7.2.9","v7.3.0","v7.3.0-BETA1","v7.3.0-BETA2","v7.3.0-RC1","v7.3.1","v7.3.10","v7.3.11","v7.3.2","v7.3.3","v7.3.4","v7.3.5","v7.3.6","v7.3.7","v7.3.8","v7.3.9","v7.4.0","v7.4.0-BETA1","v7.4.0-BETA2","v7.4.0-RC1","v7.4.0-RC2","v7.4.0-RC3","v7.4.1","v7.4.10","v7.4.11","v7.4.2","v7.4.3","v7.4.4","v7.4.5","v7.4.6","v7.4.7","v7.4.8","v7.4.9"]},{"source":"osv","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.12"}]}],"versions":["v8.0.0","v8.0.1","v8.0.10","v8.0.11","v8.0.2","v8.0.3","v8.0.4","v8.0.5","v8.0.6","v8.0.7","v8.0.8","v8.0.9"]},{"source":"osv","ecosystem":"Packagist","package":"symfony/yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.4.40"}]}],"versions":["v6.0.0","v6.0.1","v6.0.10","v6.0.11","v6.0.12","v6.0.14","v6.0.16","v6.0.17","v6.0.19","v6.0.2","v6.0.3","v6.1.0","v6.1.0-BETA1","v6.1.0-BETA2","v6.1.0-RC1","v6.1.11","v6.1.2","v6.1.3","v6.1.4","v6.1.6","v6.1.8","v6.1.9","v6.2.0","v6.2.0-BETA1","v6.2.0-BETA3","v6.2.0-RC1","v6.2.0-RC2","v6.2.10","v6.2.2","v6.2.5","v6.2.7","v6.3.0","v6.3.0-BETA1","v6.3.0-RC1","v6.3.12","v6.3.3","v6.3.7","v6.3.8","v6.4.0","v6.4.0-BETA1","v6.4.0-BETA2","v6.4.0-BETA3","v6.4.0-RC1","v6.4.11","v6.4.12","v6.4.13","v6.4.18","v6.4.20","v6.4.21","v6.4.23","v6.4.24","v6.4.25","v6.4.26","v6.4.3","v6.4.30","v6.4.34","v6.4.38","v6.4.39","v6.4.7","v6.4.8"]},{"source":"osv","ecosystem":"Packagist","package":"symfony/yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.4.12"}]}],"versions":["v7.0.0","v7.0.3","v7.0.7","v7.0.8","v7.1.0","v7.1.0-BETA1","v7.1.0-RC1","v7.1.1","v7.1.11","v7.1.4","v7.1.5","v7.1.6","v7.2.0","v7.2.0-BETA1","v7.2.0-RC1","v7.2.3","v7.2.5","v7.2.6","v7.2.8","v7.2.9","v7.3.0","v7.3.0-BETA1","v7.3.0-RC1","v7.3.1","v7.3.2","v7.3.3","v7.3.5","v7.3.8","v7.4.0","v7.4.0-BETA1","v7.4.0-RC1","v7.4.0-RC2","v7.4.1","v7.4.10","v7.4.11","v7.4.6","v7.4.8"]},{"source":"osv","ecosystem":"Packagist","package":"symfony/yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.12"}]}],"versions":["v8.0.0","v8.0.1","v8.0.10","v8.0.11","v8.0.6","v8.0.8"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.1+dfsg-1","2.7.5+dfsg-1","2.7.9+dfsg-1","2.7.9+dfsg-1ubuntu2","2.7.10-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.7+dfsg-1.3ubuntu1","3.4.3+dfsg-1ubuntu4","3.4.6+dfsg-1","3.4.6+dfsg-1ubuntu0.1","3.4.6+dfsg-1ubuntu0.1+esm1","3.4.6+dfsg-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.4+dfsg-1ubuntu1","4.3.8+dfsg-1ubuntu1","4.3.8+dfsg-1ubuntu1+esm1","4.3.8+dfsg-1ubuntu1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.6+dfsg-1ubuntu7","5.4.4+dfsg-1ubuntu8","5.4.4+dfsg-1ubuntu8+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.23+dfsg-1ubuntu1","5.4.35+dfsg-3ubuntu1","6.4.5+dfsg-3ubuntu2","6.4.5+dfsg-3ubuntu3","6.4.5+dfsg-3ubuntu3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.18+dfsg-1ubuntu1","6.4.21+dfsg-2","6.4.21+dfsg-2ubuntu1","6.4.24+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.4.7+dfsg-1ubuntu1","7.4.9+dfsg-1ubuntu1","7.4.13+dfsg-2ubuntu1","7.4.14+dfsg-1ubuntu2","7.4.15+dfsg-2ubuntu2","7.4.16+dfsg-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.24+dfsg-1","7.4.5+dfsg-1ubuntu1","7.4.6+dfsg-2ubuntu1","7.4.7+dfsg-1ubuntu1"]}],"products":[{"vendor":"eemeli","product":"yaml"},{"vendor":"sensiolabs","product":"symfony"},{"vendor":"symfony","product":"symfony"},{"vendor":"symfony","product":"yaml"}],"references":[{"url":"https://github.com/symfony/symfony/security/advisories/GHSA-9frc-8383-795m","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/symfony/symfony/commit/9749cd43c5e09b3735093623670b21b9d8a056cb","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/symfony/symfony/releases/tag/v5.4.52","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/symfony/symfony/releases/tag/v6.4.40","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/symfony/symfony/releases/tag/v7.4.12","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/symfony/symfony/releases/tag/v8.0.12","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45305.yaml","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/yaml/CVE-2026-45305.yaml","tags":["web"]},{"url":"https://symfony.com/cve-2026-45305","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9frc-8383-795m"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45305.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45305","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-45305","tags":["advisory"]},{"url":"https://github.com/symfony/symfony","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-45305","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45305","tags":["report"]},{"url":"https://symfony.com/blog/cve-2026-45305-yaml-parser-redos-via-catastrophic-backtracking-in-parser-cleanup-regex","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-45305","title":"Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex","description":"Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\\Component\\Yaml\\Parser::cleanup() used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup, allowing crafted input to make parsing hang for an arbitrarily long time. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.","status":"published","published":"2026-07-14T18:50:14.83Z","modified":"2026-07-15T14:03:58.116Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T13:46:32.755125Z"}],"euvd":[{"id":"EUVD-2026-44359","description":"Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\\Component\\Yaml\\Parser::cleanup() used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup, allowing crafted input to make parsing hang for an arbitrarily long time. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.","status":"published","published":"2026-07-14T18:50:14Z","modified":"2026-07-15T14:03:58Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:19:53.226345Z"}],"ghsa":[{"id":"GHSA-9frc-8383-795m","title":"Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex","description":"### Description\n\n`Symfony\\Component\\Yaml\\Parser::cleanup()` strips the optional `%YAML` directive header, leading comments, and document start/end markers before parsing. The original regexes contained overlapping quantifiers, most notably `'#^%YAML[: ][\\d.]+.*\\n#u'`, whose `[\\d.]+` and `.*` overlap on the dot, that exhibit catastrophic backtracking on crafted input. A single oversized `%YAML` directive header (or comment / document-marker line) makes the parser hang for an arbitrarily long time, denying service.\n\n### Resolution\n\nThe four regexes in `Parser::cleanup()` (YAML directive header, leading comments, document-start marker, document-end marker) have been rewritten with possessive quantifiers and unambiguous character classes so backtracking cannot occur.\n\nThe patch for this issue is available [here](https://github.com/symfony/symfony/commit/9749cd43c5e09b3735093623670b21b9d8a056cb) for branch 5.4.\n\n### Credits\n\nSymfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it.","status":"published","published":"2026-05-27T21:34:35Z","modified":"2026-05-27T21:34:38Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:40:14.666177Z"}],"nvd":[{"id":"CVE-2026-45305","description":"Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\\Component\\Yaml\\Parser::cleanup() used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup, allowing crafted input to make parsing hang for an arbitrarily long time. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.","status":"published","published":"2026-07-14T19:17:07.187Z","modified":"2026-07-15T14:57:02.81Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:12:29.879716Z"}],"osv":[{"id":"CVE-2026-45305","title":"Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex","description":"Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\\Component\\Yaml\\Parser::cleanup() used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup, allowing crafted input to make parsing hang for an arbitrarily long time. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.","status":"published","published":"2026-07-14T18:50:14.83Z","modified":"2026-10-28T02:30:46.494007393Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:45:05.172514Z"},{"id":"DEBIAN-CVE-2026-45305","description":"Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\\Component\\Yaml\\Parser::cleanup() used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup, allowing crafted input to make parsing hang for an arbitrarily long time. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.","status":"published","published":"2026-07-14T19:17:07.187Z","modified":"2026-10-01T03:03:06.02850001Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"GHSA-9frc-8383-795m","title":"Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex","description":"### Description\n\n`Symfony\\Component\\Yaml\\Parser::cleanup()` strips the optional `%YAML` directive header, leading comments, and document start/end markers before parsing. The original regexes contained overlapping quantifiers, most notably `'#^%YAML[: ][\\d.]+.*\\n#u'`, whose `[\\d.]+` and `.*` overlap on the dot, that exhibit catastrophic backtracking on crafted input. A single oversized `%YAML` directive header (or comment / document-marker line) makes the parser hang for an arbitrarily long time, denying service.\n\n### Resolution\n\nThe four regexes in `Parser::cleanup()` (YAML directive header, leading comments, document-start marker, document-end marker) have been rewritten with possessive quantifiers and unambiguous character classes so backtracking cannot occur.\n\nThe patch for this issue is available [here](https://github.com/symfony/symfony/commit/9749cd43c5e09b3735093623670b21b9d8a056cb) for branch 5.4.\n\n### Credits\n\nSymfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it.","status":"published","published":"2026-05-27T21:34:35Z","modified":"2026-09-10T03:51:05.233135111Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:46:43.524801Z"},{"id":"UBUNTU-CVE-2026-45305","description":"Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\\Component\\Yaml\\Parser::cleanup() used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup, allowing crafted input to make parsing hang for an arbitrarily long time. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.","status":"published","published":"2026-07-14T19:17:00Z","modified":"2026-10-17T12:58:24.544347062Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:26.396868Z"},{"id":"CLSA-2026-1784077476","title":"TuxCare security update for symfony/yaml (2 CVEs)","description":"TuxCare rebuilt symfony/yaml to address 2 CVEs. Fixed in v4.4.45-p1+tuxcare.","status":"published","published":"2026-08-04T14:52:43Z","modified":"2026-10-15T09:47:59.48454146Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1784077477","title":"TuxCare security update for symfony/yaml (2 CVEs)","description":"TuxCare rebuilt symfony/yaml to address 2 CVEs. Fixed in v3.4.47-p1+tuxcare.","status":"published","published":"2026-08-04T14:52:43Z","modified":"2026-10-15T09:47:59.497006445Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1784250519","title":"TuxCare security update for symfony/yaml (1 CVE)","description":"TuxCare rebuilt symfony/yaml to address 1 CVE. Fixed in v2.8.52-p1+tuxcare.","status":"published","published":"2026-08-04T14:52:44Z","modified":"2026-10-15T09:47:59.637009462Z","updated_at":"2026-11-02T15:43:46.151924Z"}]}}