CVE-2026-45133: YAML Parser Stack Exhaustion via Unbounded Recursion in Nested Blocks, Sequences, and Mappings
Description
Symfony\Component\Yaml\Parser is the entry point for parsing YAML strings into PHP values via Yaml::parse(). When the parser is exposed to attacker-controlled input, deeply nested mappings or sequences cause both the block-level (Parser::parseBlock()) and inline (Inline::parseSequence() / Inline::parseMapping()) parsers to recurse without a depth limit. A crafted document exhausts the PHP stack and crashes the worker.
Resolution
The Parser now tracks recursion depth in a shared ParserState object across both block-level and inline parsing, with a default limit of 128. The limit is configurable via a new $maxNestingLevel argument on Parser::construct(), Yaml::parse() and Yaml::parseFile().
The patch for this issue is available here for branch 5.4.
Credits
Symfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it.
Other sources
CVE-2026-45133: YAML Parser Stack Exhaustion via Unbounded Recursion in Nested Blocks, Sequences, and Mappings
— Packagist
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, when the parser is exposed to attacker-controlled input, deeply nested mappings or sequences cause both the block-level (Parser::parseBlock()) and inline (Inline::parseSequence() / Inline::parseMapping()) parsers to recurse without a depth limit. A crafted document exhausts the PHP stack and crashes the worker. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/symfony/yamlto a version that resolves this vulnerability.Fixed in 8.0.12 - Upgrade
Upgrade
composer/symfony/yamlto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
composer/symfony/yamlto a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 8.0.12 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 5.4.52 - Upgrade
Upgrade
composer/symfony/yamlto a version that resolves this vulnerability.Fixed in 5.4.52 - Upgrade
Upgrade
debian/symfonyto a version that resolves this vulnerability.Fixed in 5.4.53+dfsg-0+deb12u1Fixed in 6.4.41+dfsg-0+deb13u1Fixed in 6.4.49+dfsg-0+deb13u1Fixed in 7.4.22+dfsg-1Fixed in 7.4.23+dfsg-1 - Upgrade
Upgrade
Symfonyto a version that resolves this vulnerability.Fixed in 5.4.52 - Upgrade
Upgrade
Symfonyto a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
Symfonyto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
Symfonyto a version that resolves this vulnerability.Fixed in 8.0.12
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45133?
CVE-2026-45133 has a risk score of 25, indicating a moderate severity level.
How does CVE-2026-45133 impact Symfony applications?
CVE-2026-45133 can lead to denial-of-service conditions due to deeply nested YAML structures.
How do I fix CVE-2026-45133 in my project?
To fix CVE-2026-45133, update to the latest version of composer/symfony/yaml or composer/symfony/symfony that contains the patch.
Can CVE-2026-45133 be exploited remotely?
Yes, CVE-2026-45133 can be exploited remotely if the YAML parser processes attacker-controlled input.
Which versions of Symfony are affected by CVE-2026-45133?
CVE-2026-45133 affects specific versions of composer/symfony/yaml and composer/symfony/symfony prior to the security update.