CVE-2026-45756: Sensiolabs Symfony DOS Vulnerability

CVE-2026-45756 Overview

CVE-2026-45756 is a denial-of-service vulnerability in the Symfony PHP framework's JsonPath component. The flaw affects Symfony versions from 7.3.0-BETA1 through 7.4.11 and 8.0.11. The component compiles attacker-controlled match() and search() filter patterns directly into preg_match() without a length cap, i-regexp restriction, or bounded backtracking. Attackers can supply crafted regular expressions that trigger catastrophic backtracking, exhausting worker CPU and causing denial of service. The issue is fixed in 7.4.12 and 8.0.12. This weakness is tracked as [CWE-400] Uncontrolled Resource Consumption.

Critical Impact
Unauthenticated remote attackers can pin worker CPU to 100% by submitting crafted JsonPath filter expressions, causing sustained denial of service against Symfony applications that expose match() or search() queries to user input.

Affected Products

Symfony 7.3.0-BETA1 through 7.4.11
Symfony 8.0.0 through 8.0.11
Applications using the symfony/json-path component with user-supplied filter expressions

Discovery Timeline

2026-07-14 - CVE-2026-45756 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-45756

Vulnerability Analysis

The JsonPath component evaluates JsonPath queries against JSON documents. Two filter functions, match() and search(), accept regular expression patterns as arguments. The component compiles these arguments directly into PHP's preg_match() engine. No length limit, i-regexp compliance check, or PCRE backtrack limit is applied before compilation. An attacker who controls part of a JsonPath expression can inject a regex pattern designed to trigger catastrophic backtracking. When PCRE evaluates such a pattern against a moderately sized input, execution time grows exponentially, saturating the CPU of the PHP-FPM or CLI worker until the request times out.

Root Cause

The root cause is missing input validation on regex arguments passed to match() and search(). The JsonCrawler class forwards user-supplied strings to preg_match() without invoking pcre.backtrack_limit guards, without restricting the pattern to the i-regexp dialect required by RFC 9535, and without capping the pattern length. Any application that evaluates JsonPath queries derived from HTTP parameters, request bodies, or API filters becomes exploitable.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. An attacker submits a JsonPath query such as $[?match(@.field, '(a+)+$')] where the pattern is engineered for exponential backtracking. Each request consumes one worker for the duration of the regex evaluation. Repeated requests exhaust the worker pool and produce a full denial-of-service condition against the application.

php

// Security patch in src/Symfony/Component/JsonPath/JsonCrawler.php
// [JsonPath] Cap regex backtracking in match()/search() to prevent ReDoS

    private const SINGULAR_ARGUMENT_FUNCTIONS = ['length', 'match', 'search'];

+    private const REGEX_BACKTRACK_LIMIT = 10000;
+
     /**
      * Comparison operators and their corresponding lengths.
      */

Source: Symfony commit 1ac2d47

The patch introduces a REGEX_BACKTRACK_LIMIT constant of 10000, applied via pcre.backtrack_limit when compiling the regex. This caps the work PCRE will perform before returning an error, preventing catastrophic backtracking.

Detection Methods for CVE-2026-45756

Indicators of Compromise

Sustained high CPU utilization on PHP worker processes correlated with HTTP requests containing JsonPath expressions
Request logs showing JsonPath filter payloads with nested quantifiers such as (a+)+, (.*)*, or (a|a)* inside match() or search() arguments
PHP-FPM slow log entries pointing to JsonCrawler.php or preg_match() frames
HTTP 502 or 504 gateway errors following requests containing ?match( or ?search( substrings

Detection Strategies

Inspect application logs for JsonPath query parameters containing regex metacharacters and long alternation groups
Enable PHP-FPM slow request logging with a threshold below the request timeout to capture stalled workers
Add web application firewall rules that flag JsonPath expressions with quantifier stacking or excessive length
Correlate CPU spikes on application servers with concurrent inbound requests to endpoints that accept JsonPath filters

Monitoring Recommendations

Track per-endpoint request duration percentiles and alert on p99 latency exceeding baseline for routes accepting JsonPath queries
Monitor pcre.backtrack_limit errors in PHP error logs as a signal of attempted exploitation post-patch
Instrument APM traces to record time spent inside Symfony\Component\JsonPath\JsonCrawler
Alert on worker pool saturation and request queue depth increases on Symfony application tiers

How to Mitigate CVE-2026-45756

Immediate Actions Required

Upgrade symfony/json-path to 7.4.12 or 8.0.12 immediately using Composer
Audit application code for endpoints that accept JsonPath expressions from untrusted input
Deploy WAF rules to reject requests containing suspect regex patterns in JsonPath arguments until the patch is applied
Reduce PHP-FPM request_terminate_timeout temporarily to limit the impact of long-running workers

Patch Information

The fix is available in Symfony 7.4.12 and 8.0.12. The patch adds a REGEX_BACKTRACK_LIMIT of 10000 applied to preg_match() calls originating from match() and search() filter functions in JsonCrawler.php. Full details are available in the GitHub Security Advisory GHSA-8v8v-g73j-492j and the v7.4.12 release notes.

Workarounds

Disallow user-supplied JsonPath expressions and accept only server-side templated queries
Set pcre.backtrack_limit to a low value such as 10000 in php.ini for the affected application
Validate JsonPath input against an allowlist and reject any expression referencing match() or search()
Place a reverse proxy timeout below the PHP worker timeout to release stalled connections

bash

# php.ini configuration to cap PCRE work per request
pcre.backtrack_limit = 10000
pcre.recursion_limit = 10000

# Composer upgrade command
composer require symfony/json-path:^7.4.12
# or for the 8.x branch
composer require symfony/json-path:^8.0.12