CVE-2026-109449: 
PHP vulnerability analysis and mitigation

CVE-2026-109449 is an unbounded nesting vulnerability in Symfony's ExpressionLanguage component that allows unauthenticated attackers to crash the PHP process by submitting deeply nested expressions. The expression parser builds its node tree without a depth limit, enabling denial-of-service via a single crafted request. Affected packages include symfony/expression-language and symfony/symfony in versions <5.4.54, >=6 <6.4.48, >=7 <7.4.21, and >=8 <8.1.9. It carries a CVSS v4 base score of 8.7 (High) (GitHub Advisory).

The root cause is CWE-674 (Uncontrolled Recursion): the ExpressionLanguage parser constructs its abstract syntax tree with no bound on nesting depth, causing excessive resource consumption when processing deeply nested constructs such as unary operators, array literals, binary operators, or property accesses (GitHub Advisory). An initial partial fix (released in 6.4.45, 7.4.18, and 8.1.6) introduced a 256-level node stack limit but missed depth added by chains of binary operators or property accesses above their first operand — for example, 60 levels of parentheses each containing 60 additions could still crash the process during cache serialization. The complete fix adds a post-parse depth check of the full node tree in addition to the incremental stack counter. Applications using #[Assert\ExpressionSyntax] are particularly exposed because the constraint passes user-supplied values directly to ExpressionLanguage::lint() (GitHub Advisory).

Successful exploitation causes a PHP process crash, resulting in a complete denial of service for the affected application. Because no authentication or user interaction is required and the attack vector is network-accessible, a single malicious HTTP request is sufficient to take down any endpoint that parses or validates untrusted expressions. There is no confidentiality or integrity impact; the vulnerability is purely an availability issue (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the advisory date. The CVE status is listed as "Reserved" with limited public detail beyond the GitHub Security Advisory (Feedly, GitHub Advisory). The vulnerability requires no privileges, no user interaction, and no special preconditions beyond the application accepting untrusted expression input, making it trivially exploitable in affected deployments. EPSS score and CISA KEV catalog status are not yet available for this CVE.

1. Reconnaissance: Identify web applications built on Symfony that expose endpoints accepting user-supplied expressions — particularly those using #[Assert\ExpressionSyntax] for input validation or any feature that calls ExpressionLanguage::parse() or ExpressionLanguage::lint() on untrusted input.
2. Craft malicious payload: Construct an expression with tens of thousands of nested operators or constructs, for example a deeply nested chain of unary negations (-(-(-(...))))) or nested array literals, exceeding the parser's ability to unwind the node tree.
3. Submit the payload: Send the crafted expression as input to the vulnerable endpoint via a standard HTTP request (e.g., a form field, API parameter, or query string that is passed to the expression parser).
4. Trigger process crash: The parser attempts to build and then free the deeply nested node tree, exhausting the PHP process stack or memory and causing a fatal crash, rendering the application unavailable (GitHub Advisory).

• Logs: PHP fatal error or segmentation fault entries in the web server error log or PHP error log coinciding with requests to expression-parsing endpoints; repeated 500 or 502 HTTP responses from the application.
• Process: Sudden termination of PHP-FPM worker processes or the PHP CLI process without a graceful shutdown; unusually high CPU or memory usage spikes immediately before process death.
• Network: Repeated HTTP requests to the same endpoint containing abnormally large or deeply structured expression payloads in request parameters or body fields.

Upgrade to the patched versions: symfony/expression-language and symfony/symfony 5.4.54, 6.4.48, 7.4.21, or 8.1.9. Note that earlier partial fixes in 6.4.45, 7.4.18, and 8.1.6 are insufficient — only the versions listed above contain the complete fix covering chained binary operators and property accesses (GitHub Advisory). If immediate upgrade is not possible, restrict or disable any application functionality that passes untrusted user input to ExpressionLanguage::parse(), ExpressionLanguage::lint(), or #[Assert\ExpressionSyntax] as a temporary workaround (Symfony Blog).

The fix was credited to Nicolas Grekas (Symfony core contributor) for both reporting and providing the patch, with additional acknowledgment to Bruno Dias from Checkmarx for assisting with CVE assignment (GitHub Advisory). Symfony published a release announcement alongside the patched versions (Symfony Blog). No broader media coverage or notable social media discussion has been identified beyond the official advisory.