CVE-2026-109449
- Source
- https://cve.org/CVERecord?id=CVE-2026-109449
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109449.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-109449
- Aliases
-
- GHSA-7rpj-w9pf-39rr
- Published
- 2026-10-15T15:19:08Z
- Modified
- 2026-10-16T02:47:31Z
- Severity
-
- 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Symfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process
- Details
-
In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed.
#[Assert\ExpressionSyntax] passes the validated value to ExpressionLanguage::lint(), so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions.
This issue affects symfony/expression-language through v5.4.53, v6.0.0-BETA1 through v6.4.47, v7.0.0-BETA1 through v7.4.20, and v8.0.0-BETA1 through v8.1.8.
- Database specific
{ "cna_assigner": "Checkmarx", "cwe_ids": [ "CWE-674" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109449.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109449.json
- https://github.com/symfony/expression-language
- https://github.com/symfony/symfony/pull/65690
- https://github.com/symfony/symfony/pull/66720
- https://github.com/symfony/symfony/pull/66723
- https://github.com/symfony/symfony/security/advisories/GHSA-7rpj-w9pf-39rr
- https://nvd.nist.gov/vuln/detail/CVE-2026-109449
- https://packagist.org/packages/symfony/expression-language
- https://symfony.com/blog/cve-2026-109449-unbounded-nesting-in-the-expression-parser-lets-untrusted-expressions-crash-the-process
Affected packages
Git / github.com/symfony/expression-language
Affected ranges
- Type
- GIT
- Repo
- https://github.com/symfony/expression-language
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixedIntroducedFixedIntroducedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "0" }, { "fixed": "v5.4.54" }, { "introduced": "v6.0.0-BETA1" }, { "fixed": "v6.4.48" }, { "introduced": "v7.0.0-BETA1" }, { "fixed": "v7.4.21" }, { "introduced": "v8.0.0-BETA1" }, { "fixed": "v8.1.9" } ], "source": "AFFECTED_FIELD" }
Affected versions
v2.*
v2.4.0-BETA1
v2.4.0-BETA2
v2.4.0-RC1
v2.5.0
v2.5.0-BETA1
v2.5.0-BETA2
v2.5.0-RC1
v2.5.1
v2.5.2
v2.6.0-BETA1
v2.6.0-BETA2
v3.*
v3.0.0
v3.0.0-BETA1
v3.0.1
v3.1.0
v3.1.0-BETA1
v3.1.0-RC1
v3.1.1
v3.1.2
v3.1.3
v3.1.4
v3.2.0
v3.2.0-BETA1
v3.2.0-RC1
v3.2.0-RC2
v3.2.1
v3.3.0
v3.3.0-BETA1
v3.3.0-RC1
v3.3.1
v3.3.2
v3.3.3
v3.3.4
v3.3.5
v3.3.6
v4.*
v4.0.0
v4.0.0-BETA1
v4.0.0-BETA2
v4.0.0-BETA3
v4.0.0-BETA4
v4.0.0-RC1
v4.0.0-RC2
v4.0.1
v4.1.0
v4.1.0-BETA1
v4.1.0-BETA2
v4.1.0-BETA3
v4.2.0
v4.2.0-BETA1
v4.2.0-BETA2
v4.2.0-RC1
v4.2.1
v4.3.0-BETA1
v4.3.0-BETA2
v5.*
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.1.0-BETA1
v5.1.0-RC1
v5.2.0
v5.2.0-BETA1
v5.2.0-BETA2
v5.2.0-BETA3
v5.2.0-RC1
v5.2.0-RC2
v5.2.1
v5.2.2
v5.2.3
v5.2.4
v5.2.7
v5.3.0-BETA1
v5.3.0-RC1
v5.4.0
v5.4.0-BETA1
v5.4.0-BETA3
v5.4.0-RC1
v5.4.10
v5.4.11
v5.4.14
v5.4.19
v5.4.21
v5.4.3
v5.4.35
v5.4.39
v5.4.40
v5.4.43
v5.4.45
v5.4.7
v5.4.8
v6.*
v6.0.0
v6.0.0-BETA1
v6.0.0-BETA3
v6.0.0-RC1
v6.1.0
v6.1.0-BETA1
v6.1.0-RC1
v6.1.2
v6.1.3
v6.2.0
v6.2.0-BETA1
v6.2.0-BETA3
v6.2.0-RC1
v6.2.2
v6.3.0
v6.3.0-BETA1
v6.3.0-RC1
v6.4.0
v6.4.0-BETA1
v6.4.0-RC1
v6.4.11
v6.4.13
v6.4.2
v6.4.24
v6.4.3
v6.4.30
v6.4.32
v6.4.42
v6.4.45
v6.4.7
v6.4.8
v7.*
v7.0.0
v7.0.0-BETA1
v7.0.0-RC1
v7.0.2
v7.1.0-BETA1
v7.1.0-RC1
v7.2.0
v7.2.0-BETA1
v7.2.0-RC1
v7.3.0
v7.3.0-BETA1
v7.3.0-RC1
v7.4.0
v7.4.0-BETA1
v7.4.0-RC1
v7.4.14
v7.4.18
v7.4.4
v7.4.8
v8.*
v8.0.0
v8.0.0-BETA1
v8.0.0-RC1
v8.1.0
v8.1.0-BETA1
v8.1.0-BETA3
v8.1.1
v8.1.6