CVE-2026-109413

In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure recursed through lexInlineMapping and lexInlineSequence for every and of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A documen...

CVE-2026-109413

The symfony/yaml component is vulnerable to a denial of service (DoS) condition due to unbounded recursion in the Yaml eParser::lexInlineStructure() function. The root cause is that the lexer recurses through lexInlineMapping() and lexInlineSequence() for every { and [ character in an inline coll...

EUVD-2026-102109

In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure recursed through lexInlineMapping and lexInlineSequence for every and of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A documen...

CLSA-2026-1787232806 TuxCare security update for symfony/yaml (1 CVE)

TuxCare rebuilt symfony/yaml to address 1 CVE. Fixed in v2.8.52-p3+tuxcare...

PT-2026-83606

TuxCare rebuilt symfony/yaml to address 1 CVE. Fixed in v2.8.52-p3+tuxcare...

CLSA-2026-1786399295 TuxCare security update for symfony/yaml (1 CVE)

TuxCare rebuilt symfony/yaml to address 1 CVE. Fixed in v2.8.52-p2+tuxcare...

PT-2026-80063

TuxCare rebuilt symfony/yaml to address 1 CVE. Fixed in v2.8.52-p2+tuxcare...

CLSA-2026-1784682954 TuxCare security update for symfony/yaml (1 CVE)

TuxCare rebuilt symfony/yaml to address 1 CVE. Fixed in v4.4.45-p2+tuxcare...

CLSA-2026-1784250519 TuxCare security update for symfony/yaml (1 CVE)

TuxCare rebuilt symfony/yaml to address 1 CVE. Fixed in v2.8.52-p1+tuxcare...

CLSA-2026-1784250517 TuxCare security update for symfony/yaml (1 CVE)

TuxCare rebuilt symfony/yaml to address 1 CVE. Fixed in v3.4.47-p2+tuxcare...

CLSA-2026-1784077477 TuxCare security update for symfony/yaml (2 CVEs)

TuxCare rebuilt symfony/yaml to address 2 CVEs. Fixed in v3.4.47-p1+tuxcare...

CLSA-2026-1784077476 TuxCare security update for symfony/yaml (2 CVEs)

TuxCare rebuilt symfony/yaml to address 2 CVEs. Fixed in v4.4.45-p1+tuxcare...

PT-2026-75466

TuxCare rebuilt symfony/yaml to address 1 CVE. Fixed in v3.4.47-p2+tuxcare...

PT-2026-75571

TuxCare rebuilt symfony/yaml to address 1 CVE. Fixed in v4.4.45-p2+tuxcare...

PT-2026-75417

TuxCare rebuilt symfony/yaml to address 2 CVEs. Fixed in v4.4.45-p1+tuxcare...

PT-2026-75467

TuxCare rebuilt symfony/yaml to address 1 CVE. Fixed in v2.8.52-p1+tuxcare...

PT-2026-75418

TuxCare rebuilt symfony/yaml to address 2 CVEs. Fixed in v3.4.47-p1+tuxcare...

CVE-2026-45133

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, when the parser is exposed to attacker-controlled input, deeply nested mappings or sequences cause both the block-level Parser::parseBlock and inline...

CVE-2026-45305 Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser::cleanup used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup,...

CVE-2026-45133 Symfony: [Yaml] Harden the parser when handling untrusted input

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, when the parser is exposed to attacker-controlled input, deeply nested mappings or sequences cause both the block-level Parser::parseBlock and inline...