CVE-2026-109413

Name of the Vulnerable Software and Affected Versions symfony/yaml versions 5.4.0 through 5.4.53 symfony/yaml versions 6.0.0-BETA1 through 6.4.44 symfony/yaml versions 7.0.0-BETA1 through 7.4.17 symfony/yaml versions 8.0.0-BETA1 through 8.1.5

Description The YamlParser::lexInlineStructure() function recurses through lexInlineMapping() and lexInlineSequence() for every { and [ in an inline collection without respecting the maxNestingLevel boundary. A YAML document containing deeply nested inline collections can exhaust the stack during lexing, leading to a process crash or a fatal error depending on the PHP version and stack settings. This issue affects any code parsing untrusted YAML, including the use of #[MapRequestPayload] when the Yaml component is installed and the endpoint does not restrict acceptFormat, allowing a single unauthenticated request with a YAML content type to trigger the failure.

Recommendations Update symfony/yaml to version 5.4.54 or later. Update symfony/yaml to version 6.4.45 or later. Update symfony/yaml to version 7.4.18 or later. Update symfony/yaml to version 8.1.6 or later.