CVE-2026-45133: Symfony: [Yaml] Harden the parser when handling untrusted input
Description
Symfony\Component\Yaml\Parser is the entry point for parsing YAML strings into PHP values via Yaml::parse(). When the parser is exposed to attacker-controlled input, deeply nested mappings or sequences cause both the block-level (Parser::parseBlock()) and inline (Inline::parseSequence() / Inline::parseMapping()) parsers to recurse without a depth limit. A crafted document exhausts the PHP stack and crashes the worker.
Resolution
The Parser now tracks recursion depth in a shared ParserState object across both block-level and inline parsing, with a default limit of 128. The limit is configurable via a new $maxNestingLevel argument on Parser::construct(), Yaml::parse() and Yaml::parseFile().
The patch for this issue is available here for branch 5.4.
Credits
Symfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it.
Other sources
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, when the parser is exposed to attacker-controlled input, deeply nested mappings or sequences cause both the block-level (Parser::parseBlock()) and inline (Inline::parseSequence() / Inline::parseMapping()) parsers to recurse without a depth limit. A crafted document exhausts the PHP stack and crashes the worker. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/symfony/yamlto a version that resolves this vulnerability.Fixed in 8.0.12 - Upgrade
Upgrade
composer/symfony/yamlto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
composer/symfony/yamlto a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 8.0.12 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 5.4.52 - Upgrade
Upgrade
composer/symfony/yamlto a version that resolves this vulnerability.Fixed in 5.4.52 - Upgrade
Upgrade
Symfony Component Yaml (symfony/yaml)to a version that resolves this vulnerability.Fixed in 5.4.52 - Upgrade
Upgrade
Symfony Component Yaml (symfony/yaml)to a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
Symfony Component Yaml (symfony/yaml)to a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
Symfony Component Yaml (symfony/yaml)to a version that resolves this vulnerability.Fixed in 8.0.12 - Configuration
If you cannot upgrade immediately, configure the YAML parser recursion depth limit via the new $maxNestingLevel argument on Parser::__construct(), Yaml::parse(), and Yaml::parseFile(); default limit is 128.
Symfony\Component\Yaml\Parser $maxNestingLevel (Parser::__construct()) / ParserState recursion depth limit = 128 (default)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45133?
CVE-2026-45133 has a risk score of 25, indicating a moderate severity level.
How does CVE-2026-45133 impact Symfony applications?
CVE-2026-45133 can lead to denial-of-service conditions due to deeply nested YAML structures.
How do I fix CVE-2026-45133 in my project?
To fix CVE-2026-45133, update to the latest version of composer/symfony/yaml or composer/symfony/symfony that contains the patch.
Can CVE-2026-45133 be exploited remotely?
Yes, CVE-2026-45133 can be exploited remotely if the YAML parser processes attacker-controlled input.
Which versions of Symfony are affected by CVE-2026-45133?
CVE-2026-45133 affects specific versions of composer/symfony/yaml and composer/symfony/symfony prior to the security update.