CVE-2026-45133 Overview
CVE-2026-45133 is an uncontrolled recursion vulnerability [CWE-674] in the Symfony PHP framework's YAML parser. When the parser processes attacker-controlled input, deeply nested mappings or sequences cause both the block-level Parser::parseBlock() and inline Inline::parseSequence() / Inline::parseMapping() parsers to recurse without any depth limit. A crafted YAML document exhausts the PHP stack and crashes the worker process. The issue affects Symfony versions prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12. Any application that deserializes untrusted YAML through Symfony's YAML component is exposed to remote denial-of-service conditions.
Critical Impact
A single crafted YAML payload can crash PHP worker processes remotely without authentication, disrupting availability of Symfony-based web services.
Affected Products
- Sensiolabs Symfony versions prior to 5.4.52
- Sensiolabs Symfony versions prior to 6.4.40
- Sensiolabs Symfony versions prior to 7.4.12 and 8.0.12
Discovery Timeline
- 2026-07-14 - CVE-2026-45133 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-45133
Vulnerability Analysis
The flaw resides in Symfony's YAML component, which parses YAML documents into PHP data structures. Both the block-style and inline-style parsers implement recursive descent to handle nested mappings and sequences. Neither parser enforces a maximum recursion depth. When Symfony's YAML parser receives a document with thousands of nested [[[...]]] or {{{...}}} structures, each nesting level triggers another PHP function call. The PHP stack is finite, and once it is exhausted the process terminates with a stack overflow. This crashes the worker handling the request and any in-flight work it was performing.
Root Cause
The root cause is missing input validation on structural depth. Parser::parseBlock() handles block-style nested structures, while Inline::parseSequence() and Inline::parseMapping() handle inline nested collections. All three functions invoke themselves recursively based purely on the structure of the input, with no counter to bound the recursion depth. This is a classic instance of uncontrolled recursion [CWE-674], where user-controlled complexity translates directly into control-flow depth.
Attack Vector
Exploitation requires the ability to submit YAML input to a Symfony application endpoint that calls the YAML parser. Typical exposure points include configuration upload endpoints, API request bodies accepting YAML, and CI/CD integrations that ingest user-provided YAML manifests. The attacker sends a payload containing deeply nested sequences or mappings, such as thousands of opening brackets or braces. No authentication or user interaction is required if the endpoint is publicly reachable. The result is a reliable crash of the PHP worker, and repeated requests can sustain denial of service against the application.
No public proof-of-concept exploit is currently available. Refer to the Symfony GitHub Security Advisory GHSA-c2p3-7m5p-cv8x for authoritative technical details.
Detection Methods for CVE-2026-45133
Indicators of Compromise
- Repeated PHP-FPM or worker process crashes with segmentation faults or stack overflow signatures in system logs.
- HTTP request bodies or uploaded files containing long runs of [, ], {, or } characters indicative of nested YAML payloads.
- Sudden spikes in HTTP 502 or 504 responses from endpoints that accept YAML input.
Detection Strategies
- Inspect web server and PHP-FPM logs for abnormal worker termination correlated with YAML-consuming endpoints.
- Deploy WAF rules that flag request payloads exceeding a reasonable nesting threshold for bracket and brace characters.
- Enable application-layer telemetry on Symfony YAML parsing calls to record input size and structural complexity.
Monitoring Recommendations
- Track process restart counts for PHP workers as a leading indicator of exploitation attempts.
- Alert on HTTP request payloads targeting YAML endpoints that exceed baseline size or contain unusual character distributions.
- Correlate crash events with source IPs to identify repeat offenders and enable rate limiting.
How to Mitigate CVE-2026-45133
Immediate Actions Required
- Upgrade Symfony to 5.4.52, 6.4.40, 7.4.12, or 8.0.12 depending on the branch in use.
- Audit application code for any use of Symfony\Component\Yaml\Parser or Symfony\Component\Yaml\Yaml::parse() on untrusted input.
- Restrict or authenticate endpoints that accept YAML input until patching is complete.
Patch Information
The Symfony maintainers released fixes in the following versions: Symfony v5.4.52, Symfony v6.4.40, Symfony v7.4.12, and Symfony v8.0.12. The patches introduce depth limits in the block-level and inline YAML parsers. See the GitHub Security Advisory GHSA-c2p3-7m5p-cv8x for full remediation guidance.
Workarounds
- Reject YAML input above a fixed byte size before it reaches the parser.
- Pre-validate input structure and reject documents with excessive nesting depth using a lightweight scanner.
- Disable or gate YAML-accepting endpoints behind authentication and per-user rate limits until the patch is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
