CVE-2026-49209CWE-770

Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests

Medium · published July 17, 2026

CVSS v4.0
5.3
EPSS
1%
Percentile
45.9
In the wild
Unconfirmed
What it is

Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke() iterates over the client-supplied actions array and issues a full HttpKernel sub-request for each entry; because the array size is never bounded, an authenticated client can submit a single _batch request containing thousands of actions and exhaust CPU, memory, and database connections on the application server. This issue is fixed in versions 2.36.0 and 3.1.0.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00560 · 45.9th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-07-17T16:02Z
EPSS history
Timeline
  • 17 JUL 16:02Z
    Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests
    cvelistv5