Symfony UX is a JavaScript ecosystem for Symfony. The LiveComponent controller iterates over a client‑supplied array of actions submitted to the /_batch endpoint, issuing a full HttpKernel sub‑request for each. Because the array size is unbounded, an authenticated attacker can submit a single batch request with thousands of actions, causing the application to exhaust CPU, memory and database connections. The issue, which is fixed in versions 2.36.0 and 3.1.0, is a classic resource exhaustion flaw classified as CWE‑770 and results in denial of service.

The affected product is Symfony UX’s LiveComponent component. Versions from symfony/ux 2.5.0 up to, but not including, 2.36.0 and from 3.0.x up to, but not including, 3.1.0 are vulnerable. The vendor published patches that fix the issue in symfony/ux 2.36.0 and 3.1.0.

The CVSS score of 5.3 reflects moderate impact, while the EPSS score of less than 1% suggests that exploitation is currently unlikely to be widespread. The vulnerability is not listed in the CISA KEV catalog. An attacker with valid authentication can trigger the resource exhaustion by submitting a large actions array to the /_batch endpoint, leading to service degradation or an outage.