Unbounded recursion in Symfony's YAML Inline lexer causes stack exhaustion when parsing deeply nested inline collections. The flaw resides in Yaml\Parser::lexInlineStructure which recurses without respecting the parser's maxNestingLevel limit, leading to a fatal error or process crash. An attacker can trigger this with a single unauthenticated HTTP request containing a malicious YAML payload, resulting in denial of service for the affected application.

The vulnerability affects the Symfony framework (YAML component) in all releases before 5.4.54, 6.4.45, 7.4.18, 8.1.6, and the intermediary beta ranges listed. Any installation that parses untrusted YAML, such as controllers using #[MapRequestPayload] without restricting acceptFormat, is affected.

The CVSS score of 8.7 indicates high severity, but the EPSS score of less than 1% suggests a very low current exploitation probability. The issue is not in the CISA KEV catalog. An attacker can exploit this remotely via HTTP by sending a crafted YAML document; no privileged access is required. The lack of a defensive workaround increases the risk for unsupplemented systems.