Advisory Database
  • Advisories
  • Dependency Scanning
  1. composer
  2. ›
  3. symfony/yaml
  4. ›
  5. CVE-2026-45133

CVE-2026-45133: Symfony hardened the parser when handling untrusted input

May 27, 2026

Symfony\Component\Yaml\Parser is the entry point for parsing YAML strings into PHP values via Yaml::parse(). When the parser is exposed to attacker-controlled input, deeply nested mappings or sequences cause both the block-level (Parser::parseBlock()) and inline (Inline::parseSequence() / Inline::parseMapping()) parsers to recurse without a depth limit. A crafted document exhausts the PHP stack and crashes the worker.

References

  • github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45133.yaml
  • github.com/FriendsOfPHP/security-advisories/blob/master/symfony/yaml/CVE-2026-45133.yaml
  • github.com/advisories/GHSA-c2p3-7m5p-cv8x
  • github.com/symfony/symfony/commit/914f427ed9630ddb3904dafba763e53d9f133fe3
  • github.com/symfony/symfony/security/advisories/GHSA-c2p3-7m5p-cv8x
  • nvd.nist.gov/vuln/detail/CVE-2026-45133
  • symfony.com/cve-2026-45133

Code Behaviors & Features

Detect and mitigate CVE-2026-45133 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 5.4.52, all versions starting from 6.0.0 before 6.4.40, all versions starting from 7.0.0 before 7.4.12, all versions starting from 8.0.0 before 8.0.12

Fixed versions

  • 5.4.52
  • 6.4.40
  • 7.4.12
  • 8.0.12

Solution

Upgrade to versions 5.4.52, 6.4.40, 7.4.12, 8.0.12 or above.

Impact 5.3 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Learn more about CVSS

Weakness

  • CWE-1333: Inefficient Regular Expression Complexity
  • CWE-674: Uncontrolled Recursion
  • CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Source file

packagist/symfony/yaml/CVE-2026-45133.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Tue, 23 Jun 2026 12:24:26 +0000.