PT-2026-44150 · Symfony · Symfony

Published 2026-05-21 · Updated 2026-05-27 · CVE-2026-45305

Positive Technologies (AI Summary)

CVSS v4.0

2.7

Low

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 5.4.31

Description The cleanup() function in SymfonyComponentYamlParser contains regular expressions with overlapping quantifiers, specifically in the pattern used to strip the %YAML directive header. This leads to catastrophic backtracking—a state where the regex engine takes an exponential amount of time to process a string—when processing specially crafted input. An oversized directive header, comment, or document-marker line can cause the parser to hang, resulting in a denial of service.

Recommendations Update to version 5.4.31 or later. As a temporary workaround, restrict the input provided to the cleanup() function to prevent the processing of oversized directive headers or comments.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2026-45305

GHSA-9FRC-8383-795M

Affected Products

Symfony

References · 13

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/yaml/CVE-2026-45305.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45305.yaml · Exploit
• https://ubuntu.com/security/CVE-2026-45305 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-45305 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9frc-8383-795m · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-45305 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-45305 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-45305 · Security Note
• https://github.com/symfony/symfony · Note
• https://github.com/symfony/symfony/security/advisories/GHSA-9frc-8383-795m · Note
• https://github.com/symfony/symfony/commit/9749cd43c5e09b3735093623670b21b9d8a056cb · Note
• https://symfony.com/blog/cve-2026-45305-yaml-parser-redos-via-catastrophic-backtracking-in-parser-cleanup-regex · Note
• https://symfony.com/cve-2026-45305 · Note