CVE-2026-45305
Fixed in a distro release EPSS <1%CVSS 8.7
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser::cleanup() used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup, allowing crafted input to make parsing hang for an arbitrarily long time. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
Products: symfony, symfony yaml
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | symfony/symfony | 5.4.52 |
| Packagist | symfony/symfony | 6.4.40 |
| Packagist | symfony/symfony | 7.4.12 |
| Packagist | symfony/symfony | 8.0.12 |
| Packagist | symfony/yaml | 5.4.52 |
| Packagist | symfony/yaml | 6.4.40 |
| Packagist | symfony/yaml | 7.4.12 |
| Packagist | symfony/yaml | 8.0.12 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | zabbix-web-nginx-pgsql-fips-6.0 | 6.0.45-r4 |
| Chainguard | zabbix-web-nginx-pgsql-fips-7.0 | 7.0.25-r1 |
| Debian 12 | symfony | 5.4.53+dfsg-0+deb12u1 |
| Debian 13 | symfony | 6.4.41+dfsg-0+deb13u1 |
| Debian 14 | symfony | 7.4.12+dfsg-1 |
| Ubuntu 16.04 LTS | symfony | no fix |
| Ubuntu 25.10 | symfony | no fix |
| Ubuntu 26.04 LTS | symfony | no fix |
| Ubuntu 26.10 | symfony | no fix |
| Ubuntu Pro 18.04 LTS | symfony | no fix |
| Ubuntu Pro 20.04 LTS | symfony | no fix |
| Ubuntu Pro 22.04 LTS | symfony | no fix |
| Ubuntu Pro 24.04 LTS | symfony | no fix |