PT-2026-114985 · Git+1 · Expression-Language+1
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
symfony/expression-language versions prior to 5.4.54
symfony/expression-language versions 6.0.0-BETA1 through 6.4.47
symfony/expression-language versions 7.0.0-BETA1 through 7.4.20
symfony/expression-language versions 8.0.0-BETA1 through 8.1.8
Description
The parser of the ExpressionLanguage component builds its node tree without a depth limit. An expression containing tens of thousands of nested unary operators, array literals, binary operators, or property accesses can crash the PHP process during the tree freeing process. This can occur when an application validates user-provided expressions via the
ExpressionLanguage::lint() function, which is utilized by #[AssertExpressionSyntax], allowing a single request to crash the system.Recommendations
Update to version 5.4.54 or later.
Update to version 6.4.48 or later.
Update to version 7.4.21 or later.
Update to version 8.1.9 or later.
Exploit
Fix
Uncontrolled Recursion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Expression-Language
Symfony