2.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45133

CVE-2026-45133: Symfony hardened the parser when handling untrusted input

Description

Symfony\Component\Yaml\Parser is the entry point for parsing YAML strings into PHP values via Yaml::parse(). When the parser is exposed to attacker-controlled input, deeply nested mappings or sequences cause both the block-level (Parser::parseBlock()) and inline (Inline::parseSequence() / Inline::parseMapping()) parsers to recurse without a depth limit. A crafted document exhausts the PHP stack and crashes the worker.

Resolution

The Parser now tracks recursion depth in a shared ParserState object across both block-level and inline parsing, with a default limit of 128. The limit is configurable via a new $maxNestingLevel argument on Parser::__construct(), Yaml::parse() and Yaml::parseFile().

The patch for this issue is available here for branch 5.4.

Credits

Symfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45133

CVE-2026-45133:

2.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
symfony/yaml	composer	< 5.4.52	5.4.52
symfony/symfony	composer	< 5.4.52	5.4.52
symfony/symfony	composer	>= 6.0.0, < 6.4.40	6.4.40
symfony/symfony	composer	>= 7.0.0, < 7.4.12	7.4.12
symfony/symfony	composer	>= 8.0.0, < 8.0.12	8.0.12
symfony/yaml	composer	>= 6.0.0, < 6.4.40	6.4.40
symfony/yaml	composer	>= 7.0.0, < 7.4.12	7.4.12
symfony/yaml	composer	>= 8.0.0, < 8.0.12	8.0.12

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the Symfony YAML component's parser, which was susceptible to uncontrolled recursion when handling deeply nested YAML structures. This could lead to a denial-of-service (DoS) due to stack exhaustion. The analysis of the provided patch commit reveals that the core of the vulnerability was in the Parser::parseBlock, Inline::parseSequence, and Inline::parseMapping functions. These functions, responsible for parsing different parts of the YAML syntax, would recursively call themselves or each other without any limit on the nesting depth.

The fix introduces a ParserState object that is shared across the parsing process to track the current nesting level. A maximum nesting depth is now enforced (defaulting to 128). The vulnerable functions parseBlock, parseSequence, and parseMapping were modified to check this nesting level before proceeding with recursion, throwing a ParseException if the limit is exceeded. The main entry points for the parser, Yaml::parse and Yaml::parseFile, were also updated to allow configuration of this new maximum nesting level.

Vulnerable functions

Symfony\Component\Yaml\Parser::parseBlock

src/Symfony/Component/Yaml/Parser.php

This function is responsible for parsing block-level YAML structures. Before the patch, it could be forced into deep recursion by a crafted YAML input with deeply nested blocks, leading to a stack exhaustion denial-of-service.

Symfony\Component\Yaml\Inline::parseSequence

src/Symfony/Component/Yaml/Inline.php

This function parses inline YAML sequences (e.g., `[item1, item2]`). A crafted YAML with deeply nested inline sequences could cause this function to recurse indefinitely, leading to a stack exhaustion denial-of-service. The function recursively calls itself or `parseMapping`.

Symfony\Component\Yaml\Inline::parseMapping

src/Symfony/Component/Yaml/Inline.php

This function parses inline YAML mappings (e.g., `{key: value}`). It was vulnerable to uncontrolled recursion when parsing crafted input with deeply nested mappings, which could lead to a denial-of-service by exhausting the call stack. The function recursively calls itself or `parseSequence`.

Symfony\Component\Yaml\Yaml::parse

src/Symfony/Component/Yaml/Yaml.php

This is a primary entry point for parsing YAML strings. While not directly recursive, it initiates the parsing process that leads to the vulnerable recursive calls in `parseBlock`, `parseSequence`, and `parseMapping`. An attacker would supply a malicious string to this function.

Symfony\Component\Yaml\Yaml::parseFile

src/Symfony/Component/Yaml/Yaml.php

This is a primary entry point for parsing YAML files. It initiates the parsing process that leads to the vulnerable recursive calls. An attacker could exploit the vulnerability by providing a path to a malicious YAML file.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.