CVE-2026-123792

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 5.4.56 Symfony versions 6.x prior to 6.4.50 Symfony versions 7.x prior to 7.4.23 Symfony versions 8.x prior to 8.1.11

Description The Inline and Parser components of the Symfony Yaml component process certain YAML documents inefficiently. A specially crafted document can cause a PHP process to remain busy for extended periods, potentially leading to a denial of service. This occurs because the parser repeats work in several areas: embedded mappings in flow sequences are re-parsed for every appended scalar, causing exponential growth in parse time relative to nesting depth; mapping keys and tags scan spaces per character; and scalars in flow collections are matched against copies of the remaining collection, resulting in quadratic growth relative to input size. Additionally, nested blocks are copied at each level, consuming memory and time. Other triggers include empty sequence items followed by blank lines or anchors named 0. Any code parsing untrusted YAML with default flags is affected. In versions 7.4 and later, this includes the #[MapRequestPayload] attribute when the Yaml component is installed and the endpoint does not restrict acceptFormat. In version 6.4, #[MapRequestPayload] is affected if the application registers a yaml request format.

Recommendations Update to version 5.4.56 or later. Update to version 6.4.50 or later. Update to version 7.4.23 or later. Update to version 8.1.11 or later.