Symfony’s YAML parser uses a regular expression in the cleanup() method to strip directives, comments, and document markers. The expression contains overlapping quantifiers that trigger catastrophic backtracking when the parser processes a specially crafted YAML file. The result is an arbitrarily long processing time that can stall or crash the application, leading to a denial‑of‑service condition. This weakness is identified as CWE‑1333, a regex under‑flow vulnerability.

The vulnerability affects the Symfony framework and its Yaml component. Versions earlier than 5.4.52, 6.4.40, 7.4.12, or 8.0.12 are impacted. Any Symfony‑based web or console application that loads untrusted YAML content from these versions is potentially exposed.

The CVSS score of 8.7 indicates high severity, yet the EPSS score of less than 1% shows a low probability of exploitation in the current context, and the issue is not listed in the CISA KEV catalog. Likely attack vectors involve an attacker supplying malicious YAML where it is accepted, such as configuration files or API payloads. The vulnerability, a regex under‑flow (CWE‑1333), can be triggered remotely and would lead primarily to server slow‑downs or timeouts, without directly compromising confidentiality or integrity.