The Symfony Yaml component parses certain YAML documents with poorly designed algorithms that repeat work for each element in a flow collection or for each space in a run of characters. This causes exponential or quadratic growth in parse time and can consume a PHP worker for seconds or minutes when presented with a small crafted input. The result is a denial of service of the affected Symfony application. The vulnerability is an example of CWE‑1333 Resource Exhaustion and CWE‑407 Improper Use of Expensive Software Functions.

Any Symfony installation that uses the Yaml component with default flags and parses external YAML is vulnerable. The published versions affected are Symfony 5.4 before 5.4.56, Symfony 6.x before 6.4.50, Symfony 7.x before 7.4.23, and Symfony 8.x before 8.1.11. In Symfony 7.4 and later this also includes endpoints that use #[MapRequestPayload] with an unrestrictive acceptFormat. A single unauthenticated HTTP request with a YAML content type, or even a JSON payload sent as YAML, can trigger the slowdown.

The CVSS score of 8.7 indicates high severity. EPSS is not available, so the reported likelihood of exploitation cannot be quantified, but the vulnerability is listed in no KEV catalog. The attack vector is remote: an attacker can simply send crafted YAML (including malformed JSON that is valid YAML) to any endpoint that accepts YAML content. Because the vulnerability does not require privileged access and the parsing is performed for each request, exploitation effort is low and can easily lead to denial of service for affected applications.