~ / search / GHSA-9frc-8383-795m

GHSA-9frc-8383-795m

Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex

Source: GitHub Advisory Database (reviewed) Low CVE-2026-45305

Packages

EcosystemPackageAffectedFixed in
Packagist symfony/yaml < 5.4.52 5.4.52
Packagist symfony/symfony < 5.4.52 5.4.52
Packagist symfony/symfony >= 6.0.0, < 6.4.40 6.4.40
Packagist symfony/symfony >= 7.0.0, < 7.4.12 7.4.12
Packagist symfony/symfony >= 8.0.0, < 8.0.12 8.0.12
Packagist symfony/yaml >= 6.0.0, < 6.4.40 6.4.40
Packagist symfony/yaml >= 7.0.0, < 7.4.12 7.4.12
Packagist symfony/yaml >= 8.0.0, < 8.0.12 8.0.12

Details

As written in the advisory (Markdown source, shown as plain text).

### Description `Symfony\Component\Yaml\Parser::cleanup()` strips the optional `%YAML` directive header, leading comments, and document start/end markers before parsing. The original regexes contained overlapping quantifiers, most notably `'#^%YAML[: ][\d.]+.*\n#u'`, whose `[\d.]+` and `.*` overlap on the dot, that exhibit catastrophic backtracking on crafted input. A single oversized `%YAML` directive header (or comment / document-marker line) makes the parser hang for an arbitrarily long time, denying service. ### Resolution The four regexes in `Parser::cleanup()` (YAML directive header, leading comments, document-start marker, document-end marker) have been rewritten with possessive quantifiers and unambiguous character classes so backtracking cannot occur. The patch for this issue is available [here](https://github.com/symfony/symfony/commit/9749cd43c5e09b3735093623670b21b9d8a056cb) for branch 5.4. ### Credits Symfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it.

References

External links from the advisory. They lead to third-party sites.