Asymmetric denial of service - ReDoS In symfony
Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser::cleanup() used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup, allowing crafted input to make parsing hang for an arbitrarily long time. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 packagist | >=0 <5.4.52 || >=6.0.0 <6.4.40 || >=7.0.0 <7.4.12 || >=8.0.0 <8.0.12 | 5.4.52, 6.4.40, 7.4.12, 8.0.12 | |
packagist | >=0 <5.4.52 || >=6.0.0 <6.4.40 || >=7.0.0 <7.4.12 || >=8.0.0 <8.0.12 | 5.4.52, 6.4.40, 7.4.12, 8.0.12 | |
 debian 11 | =4.4.19+dfsg-2 || =4.4.19+dfsg-2+deb11u1 || =4.4.19+dfsg-2+deb11u2 || =4.4.19+dfsg-2+deb11u3 || =4.4.19+dfsg-2+deb11u4 || =4.4.19+dfsg-2+deb11u5 || =4.4.19+dfsg-2+deb11u6 || =4.4.19+dfsg-2+deb11u7 || =4.4.19+dfsg-3 || =5.0.0~beta2-1 || =5.0.2-1 || =5.0.4-1 || =5.2.1+dfsg-1 || =5.2.2+dfsg-1 || =5.2.3+dfsg-1 || =5.2.4+dfsg-1 || =5.2.5+dfsg-1 || =5.2.6+dfsg-1 || =5.3.10+dfsg-1 || =5.3.12+dfsg-1 || =5.3.12+dfsg-2 || =5.3.9+dfsg-1 || =5.4.0+dfsg-1 || =5.4.0+dfsg-2 || =5.4.0~beta1+dfsg-1 || =5.4.0~beta2+dfsg-1 || =5.4.0~beta3+dfsg-1 || =5.4.0~rc1+dfsg-1 || =5.4.0~rc1+dfsg-2 || =5.4.0~rc1+dfsg-3 || =5.4.1+dfsg-1 || =5.4.10+dfsg-1 || =5.4.11+dfsg-1 || =5.4.11+dfsg-2 || =5.4.12+dfsg-1 || =5.4.12+dfsg-2 || =5.4.13+dfsg-1 || =5.4.14+dfsg-1 || =5.4.15+dfsg-1 || =5.4.16+dfsg-1 || =5.4.18+dfsg-1 || =5.4.18+dfsg-2 || =5.4.18+dfsg-3 || =5.4.19+dfsg-1 || =5.4.2+dfsg-1 || =5.4.2+dfsg-2 || =5.4.2+dfsg-3 || =5.4.20+dfsg-1 || =5.4.21+dfsg-1 || =5.4.22+dfsg-1 || =5.4.22+dfsg-2 || =5.4.22+dfsg-3 || =5.4.23+dfsg-1 || =5.4.24+dfsg-1 || =5.4.25+dfsg-1 || =5.4.27+dfsg-1 || =5.4.28+dfsg-1 || =5.4.29+dfsg-1 || =5.4.30+dfsg-1 || =5.4.31+dfsg-1 || =5.4.31+dfsg-2 || =5.4.32+dfsg-1 || =5.4.33+dfsg-1 || =5.4.34+dfsg-1 || =5.4.34+dfsg-2 || =5.4.35+dfsg-1 || =5.4.35+dfsg-2 || =5.4.35+dfsg-3 || =5.4.4+dfsg-1 || =5.4.6+dfsg-1 || =5.4.8+dfsg-1 || =5.4.9+dfsg-1 || =5.4.9+dfsg-2 || =6.3.0+dfsg-1 || =6.3.0~rc1+dfsg-1 || =6.3.0~rc2+dfsg-1 || =6.3.1+dfsg-1 || =6.3.3+dfsg-1 || =6.3.4+dfsg-1 || =6.3.5+dfsg-1 || =6.3.6+dfsg-1 || =6.3.7+dfsg-1 || =6.4.0+dfsg-1 || =6.4.0~beta2+dfsg-1 || =6.4.0~beta3+dfsg-1 || =6.4.0~rc1+dfsg-1 || =6.4.0~rc2+dfsg-1 || =6.4.1+dfsg-1 || =6.4.10+dfsg-1 || =6.4.11+dfsg-1 || =6.4.12+dfsg-1 || =6.4.13+dfsg-1 || =6.4.14+dfsg-1 || =6.4.15+dfsg-1 || =6.4.16+dfsg-1 || =6.4.16+dfsg-2 || =6.4.17+dfsg-1 || =6.4.17+dfsg-2 || =6.4.17+dfsg-3 || =6.4.17+dfsg-4 || =6.4.17+dfsg-5 || =6.4.17+dfsg-6 || =6.4.18+dfsg-1 || =6.4.19+dfsg-1 || =6.4.19+dfsg-2 || =6.4.2+dfsg-1 || =6.4.20+dfsg-1 || =6.4.20+dfsg-2 || =6.4.21+dfsg-1 || =6.4.21+dfsg-2 || =6.4.24+dfsg-1 || =6.4.25+dfsg-1 || =6.4.3+dfsg-1 || =6.4.4+dfsg-1 || =6.4.4+dfsg-2 || =6.4.4+dfsg-3 || =6.4.4+dfsg-4 || =6.4.5+dfsg-1 || =6.4.5+dfsg-2 || =6.4.5+dfsg-3 || =6.4.5+dfsg-4 || =6.4.6+dfsg-1 || =6.4.7+dfsg-1 || =6.4.9+dfsg-1 || =7.0.4+dfsg-1 || =7.0.5+dfsg-1 || =7.0.6+dfsg-1 || =7.0.7+dfsg-1 || =7.1.0~beta1+dfsg-1 || =7.1.0~rc1+dfsg-1 || =7.1.2+dfsg-1 || =7.1.3+dfsg-1 || =7.1.4+dfsg-1 || =7.1.5+dfsg-1 || =7.2.0~beta1+dfsg-1 || =7.2.0~beta2+dfsg-1 || =7.2.0~rc1+dfsg-1 || =7.2.1+dfsg-1 || =7.2.2+dfsg-1 || =7.2.3+dfsg-1 || =7.2.4+dfsg-1 || =7.2.5+dfsg-1 || =7.2.6-1 || =7.3.0+dfsg-1 || =7.3.0~beta1+dfsg-1 || =7.3.0~beta2+dfsg-1 || =7.3.0~rc1+dfsg-1 || =7.3.1+dfsg-1 || =7.3.2+dfsg-1 || =7.3.3+dfsg-1 || =7.3.4+dfsg-1 || =7.3.5-1 || =7.4.0+dfsg-1 || =7.4.0+dfsg-2 || =7.4.0~beta1-1 || =7.4.0~beta1-2 || =7.4.0~beta2+dfsg-1 || =7.4.0~beta2+dfsg-2 || =7.4.0~beta2+dfsg-3 || =7.4.0~rc1+dfsg-1 || =7.4.0~rc2+dfsg-1 || =7.4.0~rc3+dfsg-1 || =7.4.10+dfsg-1 || =7.4.12+dfsg-1 || =7.4.13+dfsg-1 || =7.4.13+dfsg-2 || =7.4.14+dfsg-1 || =7.4.15+dfsg-1 || =7.4.15+dfsg-2 || =7.4.16+dfsg-1 || =7.4.17+dfsg-1 || =7.4.2+dfsg-1 || =7.4.2+dfsg-2 || =7.4.3+dfsg-1 || =7.4.4+dfsg-1 || =7.4.5+dfsg-1 || =7.4.6+dfsg-1 || =7.4.6+dfsg-2 || =7.4.7+dfsg-1 || =7.4.8+dfsg-1 || =7.4.9+dfsg-1 || =8.0.0+dfsg-1 || =8.0.0~beta2+dfsg-1 || =8.0.0~beta2+dfsg-2 || =8.0.0~rc1+dfsg-1 || =8.0.0~rc2+dfsg-1 || =8.0.0~rc3+dfsg-1 || =8.0.10-1 || =8.0.11+dfsg-1 || =8.0.12+dfsg-1 || =8.0.13+dfsg-1 || =8.0.2+dfsg-1 || =8.0.3+dfsg-1 || =8.0.4+dfsg-1 || =8.0.5+dfsg-1 || =8.0.6+dfsg-1 || =8.0.7+dfsg-1 || =8.0.8+dfsg-1 || =8.0.9+dfsg-1 || =8.1.0+dfsg-1 || =8.1.1+dfsg-1 || =8.1.3+dfsg-1 || =8.1.4+dfsg-1 || =8.1.5+dfsg-1 | - | |
debian 12 | =5.4.23+dfsg-1 || =5.4.23+dfsg-1+deb12u1 || =5.4.23+dfsg-1+deb12u2 || =5.4.23+dfsg-1+deb12u3 || =5.4.23+dfsg-1+deb12u4 || =5.4.23+dfsg-1+deb12u5 || =5.4.24+dfsg-1 || =5.4.25+dfsg-1 || =5.4.27+dfsg-1 || =5.4.28+dfsg-1 || =5.4.29+dfsg-1 || =5.4.30+dfsg-1 || =5.4.31+dfsg-1 || =5.4.31+dfsg-2 || =5.4.32+dfsg-1 || =5.4.33+dfsg-1 || =5.4.34+dfsg-1 || =5.4.34+dfsg-2 || =5.4.35+dfsg-1 || =5.4.35+dfsg-2 || =5.4.35+dfsg-3 || =5.4.52+dfsg-0+deb12u1 || >=0 <5.4.53+dfsg-0+deb12u1 | 5.4.53+dfsg-0+deb12u1 | |
debian 13 | =6.4.21+dfsg-2 || =6.4.21+dfsg-2+deb13u1 || =6.4.24+dfsg-1 || =6.4.25+dfsg-1 || =6.4.40+dfsg-0+deb13u1 || >=0 <6.4.41+dfsg-0+deb13u1 | 6.4.41+dfsg-0+deb13u1 | |
debian 14 | =6.4.21+dfsg-2 || =6.4.24+dfsg-1 || =6.4.25+dfsg-1 || =7.0.4+dfsg-1 || =7.0.5+dfsg-1 || =7.0.6+dfsg-1 || =7.0.7+dfsg-1 || =7.1.0~beta1+dfsg-1 || =7.1.0~rc1+dfsg-1 || =7.1.2+dfsg-1 || =7.1.3+dfsg-1 || =7.1.4+dfsg-1 || =7.1.5+dfsg-1 || =7.2.0~beta1+dfsg-1 || =7.2.0~beta2+dfsg-1 || =7.2.0~rc1+dfsg-1 || =7.2.1+dfsg-1 || =7.2.2+dfsg-1 || =7.2.3+dfsg-1 || =7.2.4+dfsg-1 || =7.2.5+dfsg-1 || =7.2.6-1 || =7.3.0+dfsg-1 || =7.3.0~beta1+dfsg-1 || =7.3.0~beta2+dfsg-1 || =7.3.0~rc1+dfsg-1 || =7.3.1+dfsg-1 || =7.3.2+dfsg-1 || =7.3.3+dfsg-1 || =7.3.4+dfsg-1 || =7.3.5-1 || =7.4.0+dfsg-1 || =7.4.0+dfsg-2 || =7.4.0~beta1-1 || =7.4.0~beta1-2 || =7.4.0~beta2+dfsg-1 || =7.4.0~beta2+dfsg-2 || =7.4.0~beta2+dfsg-3 || =7.4.0~rc1+dfsg-1 || =7.4.0~rc2+dfsg-1 || =7.4.0~rc3+dfsg-1 || =7.4.10+dfsg-1 || =7.4.2+dfsg-1 || =7.4.2+dfsg-2 || =7.4.3+dfsg-1 || =7.4.4+dfsg-1 || =7.4.5+dfsg-1 || =7.4.6+dfsg-1 || =7.4.6+dfsg-2 || =7.4.7+dfsg-1 || =7.4.8+dfsg-1 || =7.4.9+dfsg-1 || >=0 <7.4.12+dfsg-1 | 7.4.12+dfsg-1 |
Aliases
References
1. https://github.com/symfony/symfony/security/advisories/GHSA-9frc-8383-795m2. https://github.com/symfony/symfony/commit/9749cd43c5e09b3735093623670b21b9d8a056cb3. https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45305.yaml4. https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/yaml/CVE-2026-45305.yaml5. https://symfony.com/cve-2026-45305
Does your application use this vulnerable software?
During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.