Overview

CVE-2026-109413 is a vulnerability in the Symfony framework, specifically in the YAML parser. It allows an attacker to cause a denial of service (DoS) by providing a deeply nested YAML document that leads to unbounded recursion. This vulnerability has a CVSS score of 8.7, indicating a high severity level. The affected versions of Symfony range from 2.0.0 to the latest versions before the patches were applied.

Understanding the Vulnerability / Threat

Root Cause Analysis

The root cause of this vulnerability lies in the `Yaml\Parser::lexInlineStructure()` method, which recurses through `lexInlineMapping()` and `lexInlineSequence()` for every `{` and `[` of an inline collection. However, it does not enter the nesting level that the rest of the parser bounds with `maxNestingLevel`. This oversight allows a deeply nested inline collection, such as `[[[[...]]]]`, to exhaust the stack during lexing, causing the process to crash or end with a fatal error. This vulnerability belongs to the CWE category of CWE-400: Uncontrolled Resource Consumption, which involves the consumption of resources without limits.

Attack Surface & Vector

The attack surface for this vulnerability includes any code that parses untrusted YAML. A significant risk arises when using `#[MapRequestPayload]` with the Yaml component installed and without restricting the `acceptFormat`. In such cases, a single unauthenticated request with a YAML content type is enough to exploit the vulnerability. The attack vector involves crafting a YAML document with deeply nested inline collections. This document, when parsed, leads to unbounded recursion, causing the parser to crash or the request to end with a fatal error.

Exploitation Mechanics — Scenario Walkthrough

Scenario: Compromising a Symfony Application via Unauthenticated YAML Request 1. Initial Position: An attacker has network access to a Symfony application that uses the Yaml component for parsing request payloads without proper restrictions on the `acceptFormat`. 2. Triggering the Flaw: The attacker crafts a deeply nested YAML document, such as one containing multiple levels of inline collections (`[[[[...]]]]`). This document is sent as the content of an HTTP request with a YAML content type to an endpoint that does not restrict the `acceptFormat`. 3. What Breaks: Upon receiving the request, the Symfony YAML parser attempts to lex the inline structure of the provided YAML document. Due to the deeply nested nature of the document, the parser enters into unbounded recursion, exceeding the stack limit. This causes the parser to crash or results in a fatal error, effectively leading to a denial of service. 4. Attacker's Prize: The attacker achieves a denial of service, potentially disrupting the availability of the Symfony application. While this does not lead to code execution or data theft, it can significantly impact the application's usability and reliability.

Real-World Impact

The real-world impact of CVE-2026-109413 includes potential downtime and resource expenditure for affected Symfony applications. Attackers can exploit this vulnerability to disrupt service, which can be particularly damaging for applications that rely on Symfony for critical functionality. The exploitation of this vulnerability does not lead to data breaches or lateral movement but can be used as a vector for further attacks by degrading the security posture of the target system.

Detection & Defense

Immediate Mitigations

- Upgrade Symfony to version 5.4.54 or later. - For Symfony versions 6.x, upgrade to 6.4.45 or later. - For Symfony versions 7.x, upgrade to 7.4.18 or later. - For Symfony versions 8.x, upgrade to 8.1.6 or later.

Detection Strategies

Defenders can detect exploitation attempts by monitoring for unusual patterns in YAML payloads that could indicate an attempt to cause a stack overflow. This includes: - Monitoring for deeply nested YAML structures in incoming requests. - Implementing rate limiting on YAML parsing requests. - Using SIEM systems to detect anomalies in request patterns.

Long-Term Hardening

- Implement strict validation and sanitization of YAML input. - Limit the depth of YAML structures that can be parsed. - Use authentication and authorization to restrict who can send YAML payloads. - Regularly update Symfony to the latest version to ensure all security patches are applied.

Key Takeaways

- CVE-2026-109413 is a high-severity vulnerability in Symfony's YAML parser that can lead to a denial of service. - The vulnerability is caused by unbounded recursion in the YAML inline lexer. - Immediate mitigations include upgrading Symfony to patched versions. - Detection strategies involve monitoring for unusual YAML payload patterns. - Long-term hardening includes strict input validation and regular updates.

Sources

- GitHub Security Advisories: https://github.com/advisories/GHSA-2v3c-qxhr-7vpv - CVE Details: https://nvd.nist.gov/vuln/detail/CVE-2026-109413