Symfony is a PHP framework and a set of reusable PHP components. Prior to versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the Symfony\Component\Yaml\Parser resolved YAML collection aliases recursively, allowing a small untrusted YAML input to expand into a multi-gigabyte structure and exhaust memory. This is an instance of improper handling of recursive data structures (CWE-776) that results in a denial of service by exhausting system memory.

Symfony Symfony, the Symfony YAML component, and applications built with these components are affected. Versions prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12 are vulnerable. Any PHP application using Symfony older than these releases and that parses YAML input from external sources is at risk.

The CVSS score of 8.7 indicates high severity, yet the EPSS score is below 1% and the vulnerability is not listed in CISA KEV, suggesting a low probability of exploitation at this time. Attackers can deliver a malicious YAML payload through any interface that accepts YAML data. Based on the description, it is inferred that a remote attacker could exploit the vulnerability by feeding the payload to the parser, while a local attacker could trigger the denial of service by executing code that parses malicious YAML. The impact is limited to memory exhaustion and service disruption; no confidentiality or integrity violation is reported.