The Symfony JsonPath component, present in Symfony versions 7.3.0-BETA1 through 7.4.11 and 8.0.x prior to 8.0.12, compiles user-controlled match() and search() filter patterns directly into PHP’s preg_match() without imposing any length, i-regexp, or back‑tracking limits. This allows an attacker to supply malicious regular expressions that trigger catastrophic back‑tracking, exhausting CPU resources and leading to a denial of service. The flaw falls under CWE-1333 and CWE-400, reflecting its reliance on regex engine exploitation and resource exhaustion, while confidentiality and integrity remain unaffected.

All Symfony releases that include the JsonPath component from the 7.3.0-BETA1 series through 7.4.11 and all 8.0.x releases prior to 8.0.12 are affected. The fix was introduced in Symfony 7.4.12 and 8.0.12, which are the earliest versions that contain the mitigation.

With a CVSS score of 8.2, this vulnerability is considered High severity. The EPSS score is reported to be below 1 percent, indicating a very low current probability of exploitation, and the issue is not listed in the CISA KEV catalog. Attackers would need to supply a malicious JSON payload containing the crafted Regex to an application that passes it to JsonPath match() or search(). The lack of public exploitation data and the low EPSS suggest that immediate patching is prudent, though the attack surface remains flammable for targeted denial-of-service campaigns.