CVE-2026-45305 — Vulnetix

CVE-2026-45305 PUBLISHED CVSS 8.7 HIGH

Reported by GitHub_M · Published July 14, 2026

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser::cleanup() used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup, allowing crafted input to make parsing hang for an arbitrarily long time. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Risk Scores

CVSS 4.0

8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Products

Vendor	Product	Versions
symfony	symfony	< 5.4.52, >= 6.0.0-BETA1, < 6.4.40, >= 7.0.0-BETA1, < 7.4.12
symfony	yaml	< 5.4.52, >= 6.0.0-BETA1, < 6.4.40, >= 7.0.0-BETA1, < 7.4.12
symfony	yaml	0, 6.0.0, 7.0.0
symfony	symfony	0, 6.0.0, 7.0.0
symfony	symfony	< 5.4.52, >= 6.0.0-BETA1, < 6.4.40, >= 7.0.0-BETA1, < 7.4.12
symfony	yaml	< 5.4.52, >= 6.0.0-BETA1, < 6.4.40, >= 7.0.0-BETA1, < 7.4.12

Timeline

May 27, 2026 CVE Published
May 28, 2026 Security Advisory

References

https://github.com/symfony/symfony/security/advisories/GHSA-9frc-8383-795m x_refsource_CONFIRM
https://github.com/symfony/symfony/commit/9749cd43c5e09b3735093623670b21b9d8a056cb x_refsource_MISC
https://github.com/symfony/symfony/releases/tag/v5.4.52 x_refsource_MISC
https://github.com/symfony/symfony/releases/tag/v6.4.40 x_refsource_MISC
https://github.com/symfony/symfony/releases/tag/v7.4.12 x_refsource_MISC
https://github.com/symfony/symfony/releases/tag/v8.0.12 x_refsource_MISC
https://nvd.nist.gov/vuln/detail/CVE-2026-45305 advisory
https://github.com/advisories/GHSA-9frc-8383-795m advisory
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45305.yaml url
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/yaml/CVE-2026-45305.yaml url
https://symfony.com/cve-2026-45305 url

Open in Interactive Console →