Symfony JsonPath Vulnerability CVE-2026-45756 Triggers ReDoS Risk
A regular expression denial of service vulnerability in the Symfony JsonPath component allows attackers to exhaust CPU resources via maliciously crafted filter strings.
CVE-2026-45756 is a new security vulnerability affecting the JsonPath component in the Symfony PHP framework.
The flaw involves mishandled regular expressions during filtering. If you process untrusted input, this can lead to a Regular Expression Denial of Service condition. The vulnerability stems from how the library evaluates specific regex patterns in JsonPath filters. When an attacker supplies a specially crafted string, the regex engine enters a state of excessive computational consumption. This traps the CPU and prevents the application from handling further requests, causing a service outage for legitimate users.
Because the component handles data transformation and extraction, exposure depends on how user-provided data interacts with path expressions. Applications allowing external input to define or influence these filters are exposed. Controlling input passed to the JsonPath interpreter is a mitigation step until patches are available.
You should review your implementation of the Symfony JsonPath component to see if you process external data in ways that permit arbitrary regex construction. Organizations using affected versions should check for official updates addressing the regex parsing logic. Proactive monitoring of execution time for data processing tasks can help identify potential exploitation attempts. Fix it.