CVE-2026-45133

Symfony’s YAML parser fails to limit recursion depth when handling deeply nested mappings or sequences supplied from untrusted input. The parser’s block‑level and inline parsing functions can recurse recursively without an upper bound, ultimately exhausting the PHP stack and crashing the worker process. This results in a denial of service; the application becomes unavailable until the process is restarted. The issue is resolved in Symfony releases 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Any application or component that uses Symfony prior to 5.4.52, 6.4.40, 7.4.12, or 8.0.12 and parses YAML input—such as web applications, console commands, or other services that accept YAML payloads—is impacted. The vulnerability resides in the symfony/symfony package’s Yaml component.

The CVSS score of 8.2 indicates a high risk of denial of service, yet the EPSS score of less than 1% and absence from the CISA KEV catalog suggest limited current exploitation. The likely attack vector is any mechanism that allows an attacker to supply arbitrary YAML content to the parser, such as uploading a malicious file, submitting a crafted API payload, or providing console input. A successful attack exhausts the PHP stack, crashes the application, and disrupts service availability.