CVE-2026-45304

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-45304

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45304.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-45304

Aliases

GHSA-4qpc-3hr4-r2p4

Downstream

CGA (4)

CLSA (3)

DEBIAN (1)

DEBIAN-CVE-2026-45304

MINI (3)

UBUNTU (1)

UBUNTU-CVE-2026-45304

Published

2026-07-14T18:48:49Z

Modified

2026-10-22T02:49:06Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Symfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")

Details

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser resolved YAML collection aliases recursively, allowing a small untrusted YAML input to expand into a multi-gigabyte structure and exhaust memory. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-776"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45304.json"
}

References

Affected packages

Git / github.com/symfony/symfony

Affected ranges

Type

GIT

Repo

https://github.com/symfony/symfony

Events

Introduced

Fixed

eabc5f9ed7831fe6de8d609c5ebc29aed1f8ef8f

Introduced

aa4e97099b5a67bdc9f2387fe8d099f5c712f81c

Fixed

95a951788e30c45356278f4e4472cbbf552d0eb9

Introduced

d78c5f403d7ee794993660b1d5155536edd36fc1

Fixed

275f5cbccbcc50205206f05e599c4f57009aadb8

Introduced

2e913a829cfbbf9cb38b321bdff1806b44b192eb

Fixed

06d3b2c9a8aeb5d8493738cc51e24f6a1215827c

Fixed

e77391b2e4f18821198f010d573674c8ed4a970a

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "5.4.52"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "6.0.0"
                },
                {
                    "fixed":  "6.4.40"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "7.0.0"
                },
                {
                    "fixed":  "7.4.12"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "8.0.0"
                },
                {
                    "fixed":  "8.0.12"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "e77391b2e4f18821198f010d573674c8ed4a970a"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v5.4.52",
            "range":  [
                {
                    "fixed":  "eabc5f9ed7831fe6de8d609c5ebc29aed1f8ef8f"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "v6.4.40",
            "range":  [
                {
                    "fixed":  "95a951788e30c45356278f4e4472cbbf552d0eb9"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "v7.4.12",
            "range":  [
                {
                    "fixed":  "275f5cbccbcc50205206f05e599c4f57009aadb8"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "v8.0.12",
            "range":  [
                {
                    "fixed":  "06d3b2c9a8aeb5d8493738cc51e24f6a1215827c"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

v2.*

v2.0.0

v2.0.0-RC1

v2.0.0-RC2

v2.0.0-RC3

v2.0.0-RC4

v2.0.0-RC5

v2.0.0-RC6

v2.0.0BETA1

v2.0.0BETA2

v2.0.0BETA3

v2.0.0BETA4

v2.0.0BETA5

v2.0.0PR8

v2.1.0

v2.1.0-BETA1

v2.1.0-BETA2

v2.1.0-BETA3

v2.1.0-BETA4

v2.1.0-RC1

v2.1.0-RC2

v2.2.0-BETA1

v2.2.0-BETA2

v2.3.0-BETA1

v2.3.0-BETA2

v2.4.0-BETA1

v2.4.0-BETA2

v2.5.0-BETA1

v2.5.0-BETA2

v2.6.0-BETA1

v3.*

v3.0.0

v3.0.0-BETA1

v3.2.0-BETA1

v3.2.0-RC1

v3.3.0-BETA1

v4.*

v4.0.0-BETA1

v4.0.0-BETA2

v4.0.0-BETA3

v4.0.0-BETA4

v4.2.0-BETA1

v4.2.0-BETA2

v4.3.0-BETA1

v5.*

v5.0.0-BETA1

v5.0.0-BETA2

v5.0.0-RC1

v5.1.0-BETA1

v5.2.0-BETA1

v5.2.0-BETA2

v5.2.0-BETA3

v5.3.0-BETA1

v5.3.0-BETA2

v5.3.0-BETA3

v5.3.0-BETA4

v5.4.0

v5.4.0-BETA1

v5.4.0-BETA2

v5.4.0-BETA3

v5.4.0-RC1

v5.4.1

v5.4.10

v5.4.11

v5.4.12

v5.4.13

v5.4.14

v5.4.15

v5.4.16

v5.4.17

v5.4.18

v5.4.19

v5.4.2

v5.4.20

v5.4.21

v5.4.22

v5.4.23

v5.4.24

v5.4.25

v5.4.26

v5.4.27

v5.4.28

v5.4.29

v5.4.3

v5.4.30

v5.4.31

v5.4.32

v5.4.33

v5.4.34

v5.4.35

v5.4.36

v5.4.37

v5.4.38

v5.4.39

v5.4.4

v5.4.40

v5.4.41

v5.4.42

v5.4.43

v5.4.44

v5.4.45

v5.4.46

v5.4.47

v5.4.48

v5.4.49

v5.4.5

v5.4.50

v5.4.51

v5.4.6

v5.4.7

v5.4.8

v5.4.9

v6.*

v6.0.0-BETA1

v6.0.0-BETA2

v6.0.0-BETA3

v6.0.0-RC1

v6.1.0-BETA1

v6.1.0-BETA2

v6.1.0-RC1

v6.2.0-BETA1

v6.2.0-BETA2

v6.2.0-BETA3

v6.3.0-BETA1

v6.3.0-BETA2

v6.3.0-BETA3

v6.3.0-RC1

v6.4.0

v6.4.0-BETA1

v6.4.0-BETA2

v6.4.0-BETA3

v6.4.0-RC1

v6.4.0-RC2

v6.4.1

v6.4.10

v6.4.11

v6.4.12

v6.4.13

v6.4.14

v6.4.15

v6.4.16

v6.4.17

v6.4.18

v6.4.19

v6.4.2

v6.4.20

v6.4.21

v6.4.22

v6.4.23

v6.4.24

v6.4.25

v6.4.26

v6.4.27

v6.4.28

v6.4.29

v6.4.3

v6.4.30

v6.4.31

v6.4.32

v6.4.33

v6.4.34

v6.4.35

v6.4.36

v6.4.37

v6.4.38

v6.4.39

v6.4.4

v6.4.5

v6.4.6

v6.4.7

v6.4.8

v6.4.9

v7.*

v7.0.0-BETA1

v7.0.0-BETA2

v7.0.0-BETA3

v7.0.0-RC1

v7.1.0-BETA1

v7.1.0-RC1

v7.2.0-BETA1

v7.2.0-BETA2

v7.2.0-RC1

v7.3.0-BETA1

v7.3.0-BETA2

v7.3.0-RC1

v7.4.0

v7.4.0-BETA1

v7.4.0-BETA2

v7.4.0-RC1

v7.4.0-RC2

v7.4.0-RC3

v7.4.1

v7.4.10

v7.4.11

v7.4.2

v7.4.3

v7.4.4

v7.4.5

v7.4.6

v7.4.7

v7.4.8

v7.4.9

v8.*

v8.0.0

v8.0.1

v8.0.10

v8.0.11

v8.0.2

v8.0.3

v8.0.4

v8.0.5

v8.0.6

v8.0.7

v8.0.8

v8.0.9

Other

vPR3

vPR4

vPR5

vPR6

vPR8

vPR9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45304.json"