Cloudanix VulnDB

CVE-2026-45133

Medium · 5.3

Symfony hardened the parser when handling untrusted input

CVSS

5.3

EPSS

0.6%

Published

May 27, 2026

CISA due date

—

The record

`Symfony\Component\Yaml\Parser` is the entry point for parsing YAML strings into PHP values via `Yaml::parse()`. When the parser is exposed to attacker-controlled input, deeply nested mappings or sequences cause both the block-level (`Parser::parseBlock()`) and inline (`Inline::parseSequence()` / `Inline::parseMapping()`) parsers to recurse without a depth limit. A crafted document exhausts the PHP stack and crashes the worker.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities