CVE-2026-109449

Name of the Vulnerable Software and Affected Versions symfony/expression-language versions prior to 5.4.54 symfony/expression-language versions 6.0.0-BETA1 through 6.4.47 symfony/expression-language versions 7.0.0-BETA1 through 7.4.20 symfony/expression-language versions 8.0.0-BETA1 through 8.1.8

Description The parser of the ExpressionLanguage component builds its node tree without a depth limit. An expression containing tens of thousands of nested unary operators, array literals, binary operators, or property accesses can crash the PHP process during the tree freeing process. This can occur when an application validates user-provided expressions via the ExpressionLanguage::lint() function, which is utilized by #[AssertExpressionSyntax], allowing a single request to crash the system.

Recommendations Update to version 5.4.54 or later. Update to version 6.4.48 or later. Update to version 7.4.21 or later. Update to version 8.1.9 or later.