CVE-2026-45305CWE-1333

Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex

High · published July 14, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
52.0
In the wild
Unconfirmed
What it is

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser::cleanup() used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup, allowing crafted input to make parsing hang for an arbitrarily long time. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00684 · 52.0th percentile
Weakness
CWE-1333 · Inefficient Regular Expression Complexity
Published
2026-07-14T18:50Z
EPSS history
Timeline
  • 14 JUL 18:50Z
    Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
    cvelistv5