CVE-2026-45305: Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
Description
Symfony\Component\Yaml\Parser::cleanup() strips the optional %YAML directive header, leading comments, and document start/end markers before parsing. The original regexes contained overlapping quantifiers, most notably '#^%YAML[: ][\d.]+.\n#u', whose [\d.]+ and . overlap on the dot, that exhibit catastrophic backtracking on crafted input. A single oversized %YAML directive header (or comment / document-marker line) makes the parser hang for an arbitrarily long time, denying service.
Resolution
The four regexes in Parser::cleanup() (YAML directive header, leading comments, document-start marker, document-end marker) have been rewritten with possessive quantifiers and unambiguous character classes so backtracking cannot occur.
The patch for this issue is available here for branch 5.4.
Credits
Symfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it.
Other sources
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser::cleanup() used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup, allowing crafted input to make parsing hang for an arbitrarily long time. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/symfony/yamlto a version that resolves this vulnerability.Fixed in 8.0.12 - Upgrade
Upgrade
composer/symfony/yamlto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
composer/symfony/yamlto a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 8.0.12 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 5.4.52 - Upgrade
Upgrade
composer/symfony/yamlto a version that resolves this vulnerability.Fixed in 5.4.52 - Upgrade
Upgrade
Symfony\Component\Yaml\Parserto a version that resolves this vulnerability.Fixed in 5.4.52 - Upgrade
Upgrade
Symfony\Component\Yaml\Parserto a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
Symfony\Component\Yaml\Parserto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
Symfony\Component\Yaml\Parserto a version that resolves this vulnerability.Fixed in 8.0.12 - Compensating control
Apply a defensive input/traffic control to limit the impact of YAML parsing DoS (e.g., rate-limit requests and cap maximum request body size before Symfony parses YAML), since crafted YAML can make Parser::cleanup() hang for an arbitrarily long time prior to the fixed versions.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45305?
The severity of CVE-2026-45305 is rated at risk level 29.
What vulnerability does CVE-2026-45305 describe?
CVE-2026-45305 describes an issue in Symfony's YAML parser where it incorrectly handles the `%YAML` directive header due to overlapping regex quantifiers.
How do I fix CVE-2026-45305?
To fix CVE-2026-45305, update your Symfony components to the latest stable version where the vulnerability has been addressed.
Which software is affected by CVE-2026-45305?
CVE-2026-45305 affects the Symfony YAML component as well as the Symfony framework itself.
When was CVE-2026-45305 published?
CVE-2026-45305 was published on May 27, 2026.