High severity7.5NVD Advisory· Published Jul 14, 2026· Updated Jul 15, 2026
CVE-2026-45305
CVE-2026-45305
Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser::cleanup() used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup, allowing crafted input to make parsing hang for an arbitrarily long time. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
symfony/yamlPackagist | < 5.4.52 | 5.4.52 |
symfony/symfonyPackagist | < 5.4.52 | 5.4.52 |
symfony/symfonyPackagist | >= 6.0.0, < 6.4.40 | 6.4.40 |
symfony/symfonyPackagist | >= 7.0.0, < 7.4.12 | 7.4.12 |
symfony/symfonyPackagist | >= 8.0.0, < 8.0.12 | 8.0.12 |
symfony/yamlPackagist | >= 6.0.0, < 6.4.40 | 6.4.40 |
symfony/yamlPackagist | >= 7.0.0, < 7.4.12 | 7.4.12 |
symfony/yamlPackagist | >= 8.0.0, < 8.0.12 | 8.0.12 |
Affected products
1Patches
Vulnerability mechanics
References
10- github.com/symfony/symfony/commit/9749cd43c5e09b3735093623670b21b9d8a056cbnvdPatchWEB
- github.com/symfony/symfony/security/advisories/GHSA-9frc-8383-795mnvdPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-9frc-8383-795mghsaADVISORY
- github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45305.yamlghsaWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/symfony/yaml/CVE-2026-45305.yamlghsaWEB
- github.com/symfony/symfony/releases/tag/v5.4.52nvdProductRelease Notes
- github.com/symfony/symfony/releases/tag/v6.4.40nvdProductRelease Notes
- github.com/symfony/symfony/releases/tag/v7.4.12nvdProductRelease Notes
- github.com/symfony/symfony/releases/tag/v8.0.12nvdProductRelease Notes
- symfony.com/cve-2026-45305ghsaWEB
News mentions
0No linked articles in our index yet.