Cloudanix VulnDB

CVE-2026-45304

Medium · 5.3

Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")

CVSS

5.3

EPSS

0.7%

Published

May 27, 2026

CISA due date

—

The record

`Symfony\Component\Yaml\Parser` resolves YAML aliases (`*anchor`) during parsing. Aliases that reference *collections* (arrays, `stdClass`, `TaggedValue`-wrapped collections) can themselves point to other collections containing aliases, creating exponential expansion at resolution time. A small input can blow up into a multi-gigabyte structure and exhaust memory: the classic "Billion Laughs" denial-of-service against any parser exposed to untrusted YAML.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities