PT-2026-44728 · Symfony · Symfony

Published 2026-05-21 · Updated 2026-05-28 · CVE-2026-45756

Positive Technologies (AI Summary)

CVSS v4.0

2.7

Low

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 7.4

Description The JsonPath component contains an issue where the match() and search() filter functions compile caller-supplied patterns directly into preg match() without sufficient restrictions on length or backtracking. An application that evaluates attacker-influenced JSONPath expressions server-side can be subjected to catastrophic backtracking, a condition where a complex regular expression takes an exponential amount of time to process, leading to CPU exhaustion and a denial of service. Because these calls are suppressed, errors do not appear in logs.

Recommendations Update to version 7.4 or later. As a temporary workaround, restrict the use of attacker-influenced input in JSONPath expressions, specifically avoiding the match() and search() filter functions.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-1333

CWE-400

Related Identifiers

CVE-2026-45756

GHSA-8V8V-G73J-492J

Affected Products

Symfony

References · 13

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/json-path/CVE-2026-45756.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45756.yaml · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-45756 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-45756 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-45756 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-45756 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8v8v-g73j-492j · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-45756 · Vendor Advisory
• https://github.com/symfony/symfony · Note
• https://github.com/symfony/symfony/security/advisories/GHSA-8v8v-g73j-492j · Note
• https://github.com/symfony/symfony/commit/1ac2d47418ec23066112db1e6ca35be6fe123d14 · Note
• https://symfony.com/cve-2026-45756 · Note
• https://symfony.com/blog/cve-2026-45756-jsonpath-evaluates-attacker-controlled-regular-expressions-in-match-search-without-limits-redos · Note