CVE-2026-49209: Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests
Description
Symfony\UX\LiveComponent\Controller\BatchActionController::invoke() iterates over the client-supplied actions array and issues a full HttpKernel sub-request for each entry (event subscribers, validators, Doctrine, rendering). The array size is never bounded, so an authenticated client can submit a single batch request containing thousands of actions and exhaust CPU, memory, and database connections on the application server.
Resolution
BatchActionController now enforces an upper bound of 50 actions per batch request (MAXACTIONSPERBATCH) and rejects larger payloads up front with a BadRequestHttpException. The matching JavaScript backend was also updated to split larger client-side batches into multiple requests so legitimate usage isn't affected.
The patch for this issue is available here for branch 2.x (and forward-ported to 3.x).
Credits
Symfony would like to thank Pascal Cescon for reporting the issue and Hugo Alliaume for providing the fix.
Other sources
Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Controller\BatchActionController::invoke() iterates over the client-supplied actions array and issues a full HttpKernel sub-request for each entry; because the array size is never bounded, an authenticated client can submit a single batch request containing thousands of actions and exhaust CPU, memory, and database connections on the application server. This issue is fixed in versions 2.36.0 and 3.1.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/symfony/ux-live-componentto a version that resolves this vulnerability.Fixed in 3.1.0 - Upgrade
Upgrade
composer/symfony/ux-live-componentto a version that resolves this vulnerability.Fixed in 2.36.0 - Upgrade
Upgrade
Symfony UX (symfony/ux-live-component)to a version that resolves this vulnerability.Fixed in 2.36.0 - Upgrade
Upgrade
Symfony UX (symfony/ux-live-component)to a version that resolves this vulnerability.Fixed in 3.1.0 - Configuration
Update/patch BatchActionController to enforce MAX_ACTIONS_PER_BATCH=50 and reject any _batch request with more than 50 actions by throwing BadRequestHttpException.
Symfony\UX\LiveComponent\Controller\BatchActionController MAX_ACTIONS_PER_BATCH upper bound for _batch actions payload = 50
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49209?
CVE-2026-49209 has a severity rating of medium with a CVSS score of 5.3.
What vulnerability does CVE-2026-49209 address?
CVE-2026-49209 addresses a denial of service vulnerability in Symfony UX due to unbounded batch action requests.
How do I fix CVE-2026-49209?
To fix CVE-2026-49209, you should upgrade to the latest version of the Symfony UX Live Component package that includes the patch.
What are the potential impacts of CVE-2026-49209?
The potential impacts of CVE-2026-49209 include the possibility of denial of service, leading to application performance issues.
Who is affected by CVE-2026-49209?
CVE-2026-49209 affects users of the Symfony UX Live Component who utilize the batch action feature without restrictions.