CVE-2026-45305 json
Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
published 2026-05-27 5 mo ago modified 2026-09-10 1 mo ago also GHSA-9frc-8383-795m , EUVD-2026-44359
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser::cleanup() used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup, allowing crafted input to make parsing hang for an arbitrarily long time. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
Patch / fix
- packagist symfony/yaml 5.4.52, 6.4.40, 7.4.12, 8.0.12
- packagist symfony/symfony 5.4.52, 6.4.40, 7.4.12, 8.0.12
- sensiolabs symfony 5.4.52, 6.4.40, 7.4.12, 8.0.12
- symfony Debian 12 5.4.53+dfsg-0+deb12u1
- symfony Debian 13 6.4.41+dfsg-0+deb13u1
- symfony Debian 14 7.4.12+dfsg-1
debian advisories DEBIAN-CVE-2026-45305
- github.com/symfony/symfony@9749cd4 commit
- github.com/symfony/symfony/releases/tag/v5.4.52 release
- github.com/symfony/symfony/releases/tag/v6.4.40 release
- github.com/symfony/symfony/releases/tag/v7.4.12 release
- github.com/symfony/symfony/releases/tag/v8.0.12 release
- github.com/symfony/symfony/security/advisories/GHSA-9frc-8383-795m advisory
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 3 mo ago
Exploit prediction
0.68% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | symfony/yaml | <5.4.52 >=6.0.0, <6.4.40 >=7.0.0, <7.4.12 >=8.0.0, <8.0.12 |
5.4.52 6.4.40 7.4.12 8.0.12 |
| packagist | symfony/symfony | <5.4.52 >=6.0.0, <6.4.40 >=7.0.0, <7.4.12 >=8.0.0, <8.0.12 |
5.4.52 6.4.40 7.4.12 8.0.12 |
Affected products
- symfony symfony
- symfony yaml
Classification
- Weakness
-
- CWE-1333 Inefficient Regular Expression Complexity
References
-
github.com
/symfony/symfony/commit/9749cd43c5e09b3735093623670b21b9d8a056cb
web, patch
-
github.com
/symfony/symfony/security/advisories/GHSA-9frc-8383-795m
web, patch, vendor-advisory
-
github.com
/symfony/symfony/releases/tag/v5.4.52
product, release-notes
-
github.com
/symfony/symfony/releases/tag/v6.4.40
product, release-notes
-
github.com
/symfony/symfony/releases/tag/v7.4.12
product, release-notes
-
github.com
/symfony/symfony/releases/tag/v8.0.12
product, release-notes
-
github.com
/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45305.yaml
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/symfony/yaml/CVE-2026-45305.yaml
web
-
github.com
/symfony/symfony
package
-
symfony.com
/cve-2026-45305
web
Sources
- CVE List CVE-2026-45305
- GitHub Advisory GHSA-9frc-8383-795m
- NVD CVE-2026-45305
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.