2.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45304

CVE-2026-45304: Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")

Description

Symfony\Component\Yaml\Parser resolves YAML aliases (*anchor) during parsing. Aliases that reference collections (arrays, stdClass, TaggedValue-wrapped collections) can themselves point to other collections containing aliases, creating exponential expansion at resolution time. A small input can blow up into a multi-gigabyte structure and exhaust memory: the classic "Billion Laughs" denial-of-service against any parser exposed to untrusted YAML.

Resolution

The Parser now counts collection alias resolutions in a shared ParserState object, with a default limit of 128, following the SnakeYAML model. Scalar aliases remain unrestricted since they cannot drive exponential growth. The limit is configurable via a new $maxAliasesForCollections argument on Parser::__construct(), Yaml::parse() and Yaml::parseFile(). A new Yaml::PARSE_EXCEPTION_ON_ALIAS flag also rejects all aliases outright when parsing fully untrusted input.

The patch for this issue is available here for branch 5.4.

Credits

Symfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45304

CVE-2026-45304:

2.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
symfony/yaml	composer	< 5.4.52	5.4.52
symfony/symfony	composer	< 5.4.52	5.4.52
symfony/symfony	composer	>= 6.0.0, < 6.4.40	6.4.40
symfony/symfony	composer	>= 7.0.0, < 7.4.12	7.4.12
symfony/symfony	composer	>= 8.0.0, < 8.0.12	8.0.12
symfony/yaml	composer	>= 6.0.0, < 6.4.40	6.4.40
symfony/yaml	composer	>= 7.0.0, < 7.4.12	7.4.12
symfony/yaml	composer	>= 8.0.0, < 8.0.12	8.0.12

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a "Billion Laughs" attack within the Symfony YAML parser, where specially crafted YAML using recursive collection aliases can lead to exponential memory allocation and a denial of service. The root cause was the absence of a mechanism to limit the resolution of these aliases.

The analysis of the patch commit e77391b2e4f18821198f010d573674c8ed4a970a pinpoints the exact functions that were vulnerable. The fix involved introducing a new counter and limit for collection aliases via the ParserState::countAlias method. This new check was strategically placed within the functions responsible for resolving aliases, thereby identifying them as the source of the vulnerability.

The key vulnerable functions identified are Symfony\Component\Yaml\Parser::doParse, Symfony\Component\Yaml\Parser::parseValue, and Symfony\Component\Yaml\Inline::evaluateScalar. These functions are directly involved in the process of resolving YAML aliases. Before the patch, they would do so without any restrictions, allowing a small, malicious YAML input to expand into a very large data structure in memory. The entry point for triggering this condition is the Symfony\Component\Yaml\Parser::parse method (and its file-based counterpart), which orchestrates the entire parsing process. During an exploit, a runtime profiler would show these functions being called recursively, consuming system memory until exhaustion.

Vulnerable functions

Symfony\Component\Yaml\Parser::parse

src/Symfony/Component/Yaml/Parser.php

This is the main method in the `Parser` class that initiates the parsing of a YAML string. It sets up the parsing state and then calls internal methods like `doParse` and `parseValue` where the vulnerable alias resolution happens. An attacker triggers the vulnerability by providing malicious input to this function, which would then lead to excessive memory consumption.

Symfony\Component\Yaml\Parser::doParse

src/Symfony/Component/Yaml/Parser.php

This function is a core part of the YAML parsing logic. The patch adds a call to `countAlias` immediately before an alias is resolved. This shows that, prior to the patch, this function would resolve collection aliases without any limit, making it directly responsible for the exponential memory expansion.

Symfony\Component\Yaml\Parser::parseValue

src/Symfony/Component/Yaml/Parser.php

This function is responsible for parsing a specific value from the YAML input. The patch introduces a call to `countAlias` when an alias reference is found. This indicates that this function was a key part of the vulnerable logic, as it would resolve aliases without restriction, contributing to the denial-of-service vulnerability.

Symfony\Component\Yaml\Inline::evaluateScalar

src/Symfony/Component/Yaml/Inline.php

This static method evaluates scalar values, which can include inline aliases. The patch added a call to `countAlias` to this function, which means it was another path through which the unlimited alias expansion could be triggered. It was vulnerable because it resolved aliases without checking for potential recursion bombs.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.