CVE-2026-45304: Sensiolabs Symfony DOS Vulnerability

CVE-2026-45304 Overview

CVE-2026-45304 is a resource exhaustion vulnerability in the Symfony PHP framework's YAML component. The Symfony\Component\Yaml\Parser resolves YAML collection aliases recursively, allowing a small untrusted YAML input to expand into a multi-gigabyte in-memory structure. This behavior enables an attacker to trigger denial of service by exhausting available memory on the target application server. The flaw affects Symfony versions prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12. It is categorized under [CWE-776] (Improper Restriction of Recursive Entity References in DTDs, also known as 'Billion Laughs Attack'). Any Symfony application that parses attacker-controlled YAML input is exposed.

Critical Impact
A single crafted YAML document can force the parser to allocate multi-gigabyte structures, crashing the PHP process and causing service-wide denial of service.

Affected Products

Symfony < 5.4.52
Symfony >= 6.0.0, < 6.4.40
Symfony >= 7.0.0, < 7.4.12 and >= 8.0.0, < 8.0.12

Discovery Timeline

2026-07-14 - CVE-2026-45304 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-45304

Vulnerability Analysis

The vulnerability resides in the YAML parsing logic within src/Symfony/Component/Yaml/Inline.php and src/Symfony/Component/Yaml/Parser.php. When the parser encounters an anchor (&ref) followed by alias references (*ref), it substitutes each alias with the referenced node. Symfony's implementation performed this substitution recursively without tracking cumulative alias expansion. An attacker can chain aliases so each layer references the previous multiple times, producing exponential growth. This is the classic 'Billion Laughs' pattern applied to YAML collections rather than XML entities. The resulting PHP array can consume gigabytes of memory in milliseconds, triggering out-of-memory termination of the PHP-FPM worker or CLI process.

Root Cause

The parser lacked a bound on how many times a single collection alias could be resolved during document processing. The fix introduces DEFAULT_MAX_ALIASES_FOR_COLLECTIONS = 128 and counts each alias resolution via $state->countAlias(), throwing a ParseException when the threshold is exceeded.

Attack Vector

Exploitation requires only that the application call Yaml::parse() (or the underlying Parser) on attacker-supplied input. Common exposure points include configuration import endpoints, API payloads accepting application/x-yaml, CI/CD manifests, and webhook receivers. No authentication or user interaction is required when the parsing endpoint is publicly reachable.

php

// Security patch in src/Symfony/Component/Yaml/Inline.php
// [Yaml] Bound collection-alias resolution in the parser
                throw new ParseException(sprintf('Reference "%s" does not exist.', $value), self::$parsedLineNumber + 1, $value, self::$parsedFilename);
            }

+           $state->countAlias($references[$value], self::$parsedLineNumber + 1, null, self::$parsedFilename);
+
            return $references[$value];
        }
// Source: https://github.com/symfony/symfony/commit/e77391b2e4f18821198f010d573674c8ed4a970a

php

// Security patch in src/Symfony/Component/Yaml/Parser.php
    public const BLOCK_SCALAR_HEADER_PATTERN = '(?P<separator>\||>)(?P<modifiers>\+|\-|\d+|\+\d+|\-\d+|\d+\+|\d+\-)?(?P<comments> +#.*)?';
    public const REFERENCE_PATTERN = '#^&(?P<ref>[^ ]++) *+(?P<value>.*)#u';
    public const DEFAULT_MAX_NESTING_LEVEL = 128;
+   public const DEFAULT_MAX_ALIASES_FOR_COLLECTIONS = 128;

    private $filename;
    private $offset = 0;
// Source: https://github.com/symfony/symfony/commit/e77391b2e4f18821198f010d573674c8ed4a970a

Detection Methods for CVE-2026-45304

Indicators of Compromise

PHP-FPM or CLI processes terminating with Allowed memory size ... exhausted errors in application logs shortly after handling YAML input.
Inbound HTTP requests carrying application/x-yaml or application/yaml payloads containing many &anchor and *alias tokens.
Sudden RSS memory spikes on web workers correlated with a single request identifier.

Detection Strategies

Inspect Symfony application logs for ParseException entries referencing alias resolution after upgrading, which indicate blocked exploitation attempts.
Parse web server logs for request bodies containing repeated YAML alias patterns such as *a chained across nested sequences or mappings.
Monitor for the WAF signature Yaml Billion Laughs, matching payloads with numerous back-referenced YAML anchors.

Monitoring Recommendations

Alert on PHP OOM kills and worker restarts correlated with specific HTTP endpoints that accept YAML.
Track outbound HTTP 500/502/504 error ratios on YAML-consuming routes as an early denial-of-service indicator.
Baseline request body size and YAML anchor counts, alerting on outliers exceeding normal operational thresholds.

How to Mitigate CVE-2026-45304

Immediate Actions Required

Upgrade Symfony to 5.4.52, 6.4.40, 7.4.12, or 8.0.12 depending on your release branch.
Audit all application code paths that call Yaml::parse() or Yaml::parseFile() on untrusted input and require authentication where possible.
Enforce request body size limits at the reverse proxy or WAF layer to reject oversized YAML payloads before they reach PHP.

Patch Information

The fix is committed in e77391b2e4f18821198f010d573674c8ed4a970a and released across four maintenance branches. Refer to the Symfony Security Advisory GHSA-4qpc-3hr4-r2p4 and the corresponding release notes for v5.4.52, v6.4.40, v7.4.12, and v8.0.12. The patch introduces a hard cap of 128 collection-alias resolutions per parse operation.

Workarounds

If patching is not immediately feasible, restrict YAML parsing to trusted sources only and disable public endpoints that accept YAML.
Lower the PHP memory_limit per request to fail fast on abusive payloads, accepting the trade-off of stricter memory bounds for legitimate workloads.
Deploy a WAF rule that rejects YAML payloads containing more than a small number of & anchor or * alias tokens.

bash

# Update via Composer to the patched branch
composer require symfony/yaml:^7.4.12

# Verify the installed version
php -r "require 'vendor/autoload.php'; echo \Symfony\Component\Yaml\Yaml::PARSE_CONSTANT;"
composer show symfony/yaml | grep versions

# Optional: cap PHP memory per request in php.ini
memory_limit = 128M