Symfony Expression Language builds parse tree without any limit on depth. An expression containing tens of thousands of nested unary operators, array literals, binary operators or property accesses will cause the PHP process to crash when the tree is freed. The vulnerability is a severe denial‑of‑service flaw (CWE‑674) that allows an attacker to bring the target application down with a single request that includes a malicious expression.

The flaw affects the Symfony Expression Language component versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9. Specifically it is present in symfony/expression-language up to v5.4.53, v6.0.0‑BETA1 through v6.4.47, v7.0.0‑BETA1 through v7.4.20, and v8.0.0‑BETA1 through v8.1.8. Any Symfony application that validates or parses user‑supplied expressions via ExpressionLanguage::lint() or similar interfaces is exposed.

The CVSS score of 8.7 indicates a high‑severity vulnerability, and the EPSS score of less than 1% suggests a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit this by supplying an excessively nested expression through any input that is passed to the expression parser, such as form validations or custom expression evaluation features. The attack requires only the ability to supply untrusted input; no elevated privileges are needed. Because the failure produces a process crash, the impact is a denial of service to the affected application.