Symfony YAML Component Vulnerability Allows Denial-of-Service Attacks
A stack overflow vulnerability in the Symfony YAML component's inline lexer enables attackers to crash applications through maliciously crafted, deeply nested input.
CVE-2026-109413 exposes the Symfony YAML component to a denial-of-service vulnerability within the inline lexer. A crafted YAML document triggers unbounded recursion during parsing. This behavior causes a stack overflow that crashes the application process.
Nested structures cause the flaw. Because the parser fails to limit recursion depth when processing inline sequences or mappings, untrusted input exhausts available system resources.
Applications processing user-supplied YAML files face exposure. Validate or restrict input before parsing to mitigate risks prior to patching.
Official patches resolve the lexer recursion issue. You should verify dependency versions and upgrade to the latest secure version of the framework to address this vulnerability.