Unauthenticated YAML Requests Crash Symfony Processes in High-Severity CVE-2026-109413 Flaw

A stack overflow vulnerability in the Symfony YAML component allows remote attackers to crash web application processes. The issue affects multiple major version branches of the framework, exposing any code that parses untrusted YAML data without strict nesting limits.

What happened

The National Vulnerability Database assigned CVE-2026-109413 to a flaw in the Symfony YAML parser component. The vulnerability stems from how the parser handles inline collections during the lexing phase. According to the NVD record, the function `Yaml\Parser::lexInlineStructure()` recurses through `lexInlineMapping()` and `lexInlineSequence()` for every curly brace or square bracket encountered. This recursion occurs without entering the nesting level checks that the rest of the parser uses to bound depth via `maxNestingLevel`.

An attacker can exploit this by submitting a document containing deeply nested inline collections, such as multiple layers of square brackets. Because the lexer does not respect the standard nesting limits, it continues to recurse until the PHP process stack is exhausted. Depending on the specific PHP version and its stack size settings, this results in either a complete process crash or a fatal error that terminates the request. The NVD rates the severity of this issue as high, with a CVSS score of 8.7.

The vulnerability affects specific version ranges within the Symfony ecosystem. Users running Symfony YAML prior to version 5.4.54 are exposed. Similarly, versions 6.0.0-BETA1 through 6.4.44, 7.0.0-BETA1 through 7.4.17, and 8.0.0-BETA1 through 8.1.5 are affected. The National Vulnerability Database lists the weakness as CWE-674, indicating a use of an externally-influenced input for resource allocation.

Why it matters

Any code that parses untrusted YAML input is potentially vulnerable to this crash condition. The impact is particularly severe for applications using the `#[MapRequestPayload]` attribute when the YAML component is installed. If an endpoint does not explicitly restrict the `acceptFormat`, it may accept YAML content types by default. In such configurations, a single unauthenticated request containing a malicious YAML payload is sufficient to trigger the stack exhaustion. This means that public-facing APIs or web forms that accept arbitrary data formats could be taken offline without requiring authentication or complex attack chains.

The lack of nesting level enforcement during lexing creates a bypass for standard security controls. Developers typically rely on `maxNestingLevel` to prevent resource exhaustion attacks, but this specific code path ignores that safeguard. Consequently, even applications with strict configuration settings may remain exposed if they process inline structures. The ability to crash a process with a single request makes this a reliable denial-of-service vector for attackers targeting Symfony-based web applications.

Our take on the response

• Identify all services running Symfony YAML versions prior to the patched releases.
• Verify if any endpoints accept YAML content types without explicit format restrictions.
• Monitor for unexpected process terminations or fatal errors in PHP logs.
• Ensure that input validation occurs before data reaches the YAML parser layer.

What defenders should look for

Security operations teams should monitor for sudden spikes in PHP fatal errors or process crashes that correlate with incoming requests. Check web server logs for requests with YAML content types, especially those originating from unauthenticated sources. Look for patterns where requests contain unusually large or complex payloads that do not result in standard application errors but instead cause immediate termination. Teams usually investigate these events by reviewing stack traces for recursion depth issues. Containment moves typically involve restricting accepted content types at the reverse proxy level or blocking suspicious user agents until patches are applied.

Background: Input validation

Input validation is the process of verifying that data entering a system matches expected formats, types, and ranges before processing. It prevents malicious payloads from executing code or crashing services. You must validate at every entry point, not just the user interface, because attackers bypass front-end checks entirely.

Read the full guide: What Is Input Validation: How to Stop Bad Data From Breaking Systems

What to do and how to stay safe: Symfony

• Audit your Symfony YAML component versions and upgrade to 5.4.54, 6.4.45, 7.4.18, or 8.1.6 or later once available.
• Restrict API endpoints to only accept necessary content types, disabling YAML parsing if it is not required.
• Implement rate limiting on endpoints that accept file uploads or complex data structures to mitigate crash impact.
• Review application logs for signs of stack overflow or fatal errors that may indicate exploitation attempts.

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Symfony versions are affected by CVE-2026-109413?

Versions prior to 5.4.54, 6.4.45, 7.4.18, and 8.1.6 are affected by this vulnerability.

How does an attacker trigger this vulnerability?

An attacker submits a YAML document with deeply nested inline collections, causing the parser to exhaust the stack.

Is authentication required to exploit this flaw?

No, a single unauthenticated request with a YAML content type is enough to trigger the crash if the endpoint accepts it.