Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser resolved YAML collection aliases recursively, allowing a small untrusted YAML input to expand into a multi-gigabyte structure and exhaust memory. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
{
"cwe_ids": [
"CWE-776"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45304.json",
"cna_assigner": "GitHub_M",
"unresolved_ranges": [
{
"extracted_events": [
{
"fixed": "5.4.52"
},
{
"introduced": "6.0.0-BETA1"
},
{
"fixed": "6.4.40"
},
{
"introduced": "7.0.0-BETA1"
},
{
"fixed": "7.4.12"
},
{
"introduced": "8.0.0-BETA1"
},
{
"fixed": "8.0.12"
},
{
"fixed": "5.4.52"
},
{
"introduced": "6.0.0-BETA1"
},
{
"fixed": "6.4.40"
},
{
"introduced": "7.0.0-BETA1"
},
{
"fixed": "7.4.12"
},
{
"introduced": "8.0.0-BETA1"
},
{
"fixed": "8.0.12"
}
],
"source": "AFFECTED_FIELD"
}
]
}{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "5.4.52"
},
{
"introduced": "6.0.0"
},
{
"fixed": "6.4.40"
},
{
"introduced": "7.0.0"
},
{
"fixed": "7.4.12"
},
{
"introduced": "8.0.0"
},
{
"fixed": "8.0.12"
}
],
"source": "CPE_RANGE"
}