Cloudanix VulnDB

CVE-2026-45305

Medium · 5.3

Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex

CVSS

5.3

EPSS

0.7%

Published

May 27, 2026

CISA due date

—

The record

`Symfony\Component\Yaml\Parser::cleanup()` strips the optional `%YAML` directive header, leading comments, and document start/end markers before parsing. The original regexes contained overlapping quantifiers, most notably `'#^%YAML[: ][\d.]+.*\n#u'`, whose `[\d.]+` and `.*` overlap on the dot, that exhibit catastrophic backtracking on crafted input. A single oversized `%YAML` directive header (or comment / document-marker line) makes the parser hang for an arbitrarily long time, denying service.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities