CVE-2026-109413: 
PHP vulnerability analysis and mitigation

CVE-2026-109413 is an unbounded recursion vulnerability in the Symfony YAML component's inline lexer that allows a single unauthenticated request to crash the PHP process or trigger a fatal error. It affects symfony/yaml and symfony/symfony versions <5.4.54, >=6 <6.4.45, >=7 <7.4.18, and >=8 <8.1.6. The vulnerability was published on October 15, 2026, by Symfony maintainer fabpot. It carries a CVSS v4 base score of 8.7 (High) (GitHub Advisory).

The root cause is uncontrolled recursion (CWE-674) in Yaml\Parser::lexInlineStructure(), which recursed through lexInlineMapping() and lexInlineSequence() for every { and [ character encountered in an inline YAML collection, without applying the maxNestingLevel bound that governs the rest of the parser. A specially crafted document consisting of deeply nested inline collections (e.g., [[[[...]]]]) exhausts the PHP call stack during lexing, causing a process crash or fatal error depending on PHP version and stack configuration. The attack vector is network-accessible with no authentication, privileges, or user interaction required, and is particularly dangerous when #[MapRequestPayload] is used with the Yaml component installed and the endpoint does not restrict acceptFormat — a single HTTP request with a YAML content type suffices (GitHub Advisory).

Successful exploitation results in a complete availability impact on the vulnerable system — the PHP process crashes or terminates with a fatal error, causing denial of service for the affected application. There is no confidentiality or integrity impact, and no subsequent system impact is expected. Any application that parses untrusted YAML input is affected, including public-facing Symfony endpoints using #[MapRequestPayload] without content-type restrictions (GitHub Advisory).

As of the disclosure date (October 15, 2026), no public proof-of-concept exploit code or in-the-wild exploitation has been reported. The CVE status is listed as "Reserved" in Feedly's tracking data. The vulnerability requires no authentication, no privileges, and no user interaction, making it trivially exploitable against any exposed endpoint that parses untrusted YAML. No EPSS score or CISA KEV catalog entry is currently available (GitHub Advisory, Feedly).

1. Reconnaissance: Identify Symfony-based web applications that accept YAML input, particularly endpoints using #[MapRequestPayload] without acceptFormat restrictions, or any other code path that parses user-supplied YAML.
2. Craft malicious payload: Construct a YAML document consisting of deeply nested inline collections, such as [[[[[[...]]]]]] or {a:{a:{a:{a:...}}}}, with nesting depth sufficient to exhaust the PHP call stack (typically hundreds to thousands of levels depending on PHP configuration).
3. Send unauthenticated request: Submit an HTTP request to the target endpoint with Content-Type: application/yaml (or equivalent) containing the crafted payload. No authentication or special headers are required.
4. Trigger crash: The Symfony YAML inline lexer recursively processes each [ or { without bounding nesting depth, exhausting the stack and causing the PHP process to crash or emit a fatal error, resulting in denial of service for the application (GitHub Advisory).

• Network: Unusual HTTP requests with Content-Type: application/yaml or text/yaml to application endpoints, especially those accepting request payloads; repeated requests from the same source IP targeting YAML-consuming endpoints.
• Logs: PHP fatal error messages referencing stack overflow or maximum nesting level exceeded in application error logs; web server logs showing 500 errors or process termination responses immediately following YAML content-type requests.
• Process: Unexpected PHP-FPM worker crashes or restarts; sudden drops in available worker processes correlating with inbound YAML requests.

Upgrade to one of the patched versions: symfony/yaml (and symfony/symfony) 5.4.54, 6.4.45, 7.4.18, or 8.1.6. The fix makes the inline lexer enter and leave the same nesting level as the rest of the parser, bounding recursion via maxNestingLevel and raising a ParseException when exceeded. As a workaround where upgrading is not immediately possible, restrict endpoints that parse YAML to authenticated users only, or enforce acceptFormat restrictions on #[MapRequestPayload] to prevent unauthenticated YAML parsing (GitHub Advisory, Symfony Releases).

The vulnerability was reported and fixed by Nicolas Grekas, a core Symfony contributor, with CVE assignment assistance from Bruno Dias of Checkmarx. Symfony published an official blog post and GitHub Security Advisory on October 15, 2026. No significant broader media coverage or notable community controversy has been observed beyond the standard disclosure channels (Symfony Blog, GitHub Advisory).