CVE-2026-109413

A flaw was found in Symfony YAML. A remote, unauthenticated attacker can trigger this vulnerability by submitting a specially crafted YAML document containing deeply nested inline collections, such as lists or mappings. Because the parser fails to enforce maximum nesting limits during inline...

Symfony and Symfony YAML Component 2.0.x < 5.4.54 / 6.0.x < 6.4.45 / 7.0.x < 7.4.18 / 8.0.x < 8.1.6 DoS

The version of Symfony and/or the Symfony YAML Component installed on the remote host is 2.0.x prior to 5.4.54, or 6.0.x prior to 6.4.45, or 7.0.x prior to 7.4.18, or 8.0.x prior to 8.1.6. It is, therefore, affected by a denial of service vulnerability. - Yaml\Parser::lexInlineStructure recursed...

EUVD-2026-102109

Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process...

Linux Distros Unpatched Vulnerability : CVE-2026-109413

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure recursed through lexInlineMapping and lexInlineSequence for...

CVE-2026-109413

In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure recursed through lexInlineMapping and lexInlineSequence for every and of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A documen...

CVE-2026-109413 Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process

In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure recursed through lexInlineMapping and lexInlineSequence for every and of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A documen...

PT-2026-114952

Name of the Vulnerable Software and Affected Versions symfony/yaml versions 5.4.0 through 5.4.53 symfony/yaml versions 6.0.0-BETA1 through 6.4.44 symfony/yaml versions 7.0.0-BETA1 through 7.4.17 symfony/yaml versions 8.0.0-BETA1 through 8.1.5 Description The YamlParser::lexInlineStructure functio...