CVE-2026-45305: Sensiolabs Symfony DOS Vulnerability

CVE-2026-45305 Overview

CVE-2026-45305 is a denial-of-service vulnerability in the Symfony PHP framework's YAML component. The flaw resides in Symfony\Component\Yaml\Parser::cleanup(), which uses regular expressions with overlapping quantifiers to strip YAML directives, comments, and document markers. Crafted input triggers catastrophic backtracking in the PHP PCRE engine, causing the parser to hang indefinitely and exhaust CPU resources [CWE-1333]. The issue affects Symfony versions prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12. Any application that parses untrusted YAML using the affected component is exposed to network-based denial of service.

Critical Impact
Remote attackers can submit crafted YAML input to any endpoint that invokes the Symfony YAML parser, causing worker processes to hang and exhaust server CPU without authentication.

Affected Products

Symfony 5.x prior to 5.4.52
Symfony 6.x prior to 6.4.40
Symfony 7.x prior to 7.4.12 and 8.x prior to 8.0.12

Discovery Timeline

2026-07-14 - CVE-2026-45305 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-45305

Vulnerability Analysis

The vulnerability is a Regular Expression Denial of Service (ReDoS) issue in the YAML component's cleanup routine. The Parser::cleanup() method preprocesses YAML input by stripping the %YAML header, leading comments, and the --- / ... document markers. Each cleanup step uses a preg_replace pattern containing quantifiers that can match the same input in exponentially many ways. When an attacker supplies input crafted to defeat the PCRE optimizer, the regex engine walks the entire backtracking tree before returning, producing parse times that scale non-linearly with input length.

Any Symfony application that deserializes YAML from user-controlled channels — configuration uploads, API bodies, webhook payloads, translation files, or CI/CD manifests — can be forced into an unbounded parse. A single request is sufficient to pin a PHP-FPM worker, and repeated requests exhaust the worker pool.

Root Cause

The original patterns used ungreedy .*? and greedy .* alternatives combined with + quantifiers on groups that could match empty or overlapping content. Patterns such as #^(\#.*?\n)+#s allow the engine to split the input across group iterations in many equivalent ways. When the trailing anchor fails to match, PCRE backtracks through every combination, producing catastrophic runtime.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker sends a crafted YAML document to any endpoint that eventually calls Yaml::parse() or Parser::parse(). The malicious payload typically consists of long runs of comment lines or header-like sequences designed to maximize backtracking depth in the vulnerable regexes.

The upstream patch replaces backtracking-prone patterns with possessive quantifiers (++, *+) and negated character classes ([^\n]*+) that prevent the engine from revisiting matched characters.

php

// strip YAML header
$count = 0;
-$value = preg_replace('#^\%YAML[: ][\d\.]+.*\n#u', '', $value, -1, $count);
+$value = preg_replace('#^%YAML[: ][\d.]++[^\n]*+\n#u', '', $value, -1, $count);
$this->offset += $count;

// remove leading comments
-$trimmedValue = preg_replace('#^(\#.*?\n)+#s', '', $value, -1, $count);
+$trimmedValue = preg_replace('#^(?:\#[^\n]*+\n)++#', '', $value, -1, $count);

// remove start of the document marker (---)
-$trimmedValue = preg_replace('#^\-\-\-.*?\n#s', '', $value, -1, $count);
+$trimmedValue = preg_replace('#^---[^\n]*+\n#', '', $value, -1, $count);

// remove end of the document marker (...)
-$value = preg_replace('#\.\.\.\s*$#', '', $value);
+$value = preg_replace('#\.\.\.[ \t]*+$#', '', $value);

Source: Symfony commit 9749cd43c5

Detection Methods for CVE-2026-45305

Indicators of Compromise

PHP-FPM or PHP-CLI worker processes consuming 100% CPU on a single core for extended periods while handling YAML input.
HTTP requests to endpoints that accept YAML bodies exhibiting response times measured in seconds or timing out at the reverse proxy.
Elevated 502 or 504 gateway responses correlated with requests containing Content-Type: application/x-yaml or text/yaml.

Detection Strategies

Instrument application logs to record parse duration for calls to Yaml::parse() and alert on durations exceeding a low threshold (for example, 250 ms).
Enable PHP max_execution_time and log timeouts so aborted parses generate a signal rather than silent worker starvation.
Inspect web application firewall telemetry for repeated YAML payloads containing long runs of # comment lines or repeated --- markers.

Monitoring Recommendations

Track PHP-FPM listen queue depth and busy worker count as leading indicators of parser-induced starvation.
Baseline CPU utilization per PHP worker pool and alert on sustained deviations from normal parse workloads.
Correlate application performance monitoring traces on the Symfony\Component\Yaml\Parser call site with upstream request metadata.

How to Mitigate CVE-2026-45305

Immediate Actions Required

Upgrade the symfony/yaml package to 5.4.52, 6.4.40, 7.4.12, or 8.0.12 depending on the release branch in use.
Audit application code and third-party bundles for direct or indirect calls to Yaml::parse() on untrusted input.
Enforce request-level PHP max_execution_time limits and reverse proxy read timeouts to bound the impact of a single malicious request.

Patch Information

The fix hardens the four preg_replace patterns in src/Symfony/Component/Yaml/Parser.php by replacing greedy and ungreedy quantifiers with possessive quantifiers and negated character classes. Fixed releases are available at Symfony v5.4.52, Symfony v6.4.40, Symfony v7.4.12, and Symfony v8.0.12. Full technical context is available in GHSA-9frc-8383-795m.

Workarounds

Reject YAML payloads exceeding a conservative byte limit at the reverse proxy or web application firewall before they reach PHP.
Set PHP pcre.backtrack_limit to a low value so pathological patterns fail fast instead of hanging the worker.
Require authentication and rate limiting on endpoints that accept YAML input to reduce anonymous exposure.

bash

# Update via Composer to the fixed release for your branch
composer require symfony/yaml:^7.4.12

# Or update the full framework metapackage
composer update symfony/symfony

# Harden PHP against catastrophic backtracking (php.ini)
# pcre.backtrack_limit = 100000
# pcre.recursion_limit = 100000
# max_execution_time = 5