GHSA-4qpc-3hr4-r2p4 CVE-2026-45304
Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.68%
- Chance of exploitation in the next 30 days. Higher than 52.59% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
- Fix
- Available
- 2 packages have a fixed version
Description
Description
Symfony\Component\Yaml\Parser resolves YAML aliases (*anchor) during parsing. Aliases that reference collections (arrays, stdClass, TaggedValue-wrapped collections) can themselves point to other collections containing aliases, creating exponential expansion at resolution time. A small input can blow up into a multi-gigabyte structure and exhaust memory: the classic "Billion Laughs" denial-of-service against any parser exposed to untrusted YAML.
Resolution
The Parser now counts collection alias resolutions in a shared ParserState object, with a default limit of 128, following the SnakeYAML model. Scalar aliases remain unrestricted since they cannot drive exponential growth. The limit is configurable via a new $maxAliasesForCollections argument on Parser::__construct(), Yaml::parse() and Yaml::parseFile(). A new Yaml::PARSE_EXCEPTION_ON_ALIAS flag also rejects all aliases outright when parsing fully untrusted input.
The patch for this issue is available here for branch 5.4.
Credits
Symfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| symfony/symfony | < 5.4.52 |
5.4.52 |
| symfony/symfony | >= 6.0.0, < 6.4.40 |
6.4.40 |
| symfony/symfony | >= 7.0.0, < 7.4.12 |
7.4.12 |
| symfony/symfony | >= 8.0.0, < 8.0.12 |
8.0.12 |
| symfony/yaml | < 5.4.52 |
5.4.52 |
| symfony/yaml | >= 6.0.0, < 6.4.40 |
6.4.40 |
| symfony/yaml | >= 7.0.0, < 7.4.12 |
7.4.12 |
| symfony/yaml | >= 8.0.0, < 8.0.12 |
8.0.12 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
symfony/symfony Packagist → 5.4.52
- composer
composer require symfony/symfony:^5.4.52
symfony/yaml Packagist → 5.4.52
- composer
composer require symfony/yaml:^5.4.52
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- Low
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Unreported
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
How to prevent it
- Operation: If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities.
- Implementation: Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not continue parsing potentially explosive content.
References
Packages
Other links
- github.com/symfony/symfony/security/advisories/GHSA-4qpc-3hr4-r2p4
- github.com/symfony/symfony/commit/e77391b2e4f18821198f010d573674c8ed4a970a
- github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-202…
- github.com/FriendsOfPHP/security-advisories/blob/master/symfony/yaml/CVE-2026-4…
- symfony.com/cve-2026-45304
- github.com/symfony/symfony/releases/tag/v5.4.52
- github.com/symfony/symfony/releases/tag/v6.4.40
- github.com/symfony/symfony/releases/tag/v7.4.12
- github.com/symfony/symfony/releases/tag/v8.0.12
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-2v3c-qxhr-7vpv Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process | High | Also affects symfony/symfony |
| GHSA-r925-mgvr-h9cc Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header | High | Also affects symfony/symfony |
| GHSA-h5x3-xfc9-m39h Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization | Medium | Also affects symfony/symfony |
| GHSA-v3wm-qf9p-c549 Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense | Medium | Also affects symfony/symfony |
| GHSA-rrj9-5q2j-4gvr Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade | Medium | Also affects symfony/symfony |
| GHSA-38cx-cq6f-5755 Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient | High | Also affects symfony/symfony |
| GHSA-6h46-9jf5-q59x Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes | High | Also affects symfony/symfony |
| GHSA-x5qj-865h-mgvm Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes | Medium | Also affects symfony/symfony |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor