CVE-2026-49209: 
PHP vulnerability analysis and mitigation

CVE-2026-49209 is a Denial of Service vulnerability in the symfony/ux-live-component package caused by unbounded batch action request processing. The BatchActionController::__invoke() method iterates over a client-supplied actions array and issues a full HttpKernel sub-request for each entry without any limit on array size, allowing an authenticated attacker to exhaust server CPU, memory, and database connections with a single request. Affected versions are >=2.5.0, <2.36.0 and >=3.0.0, <3.1.0 of symfony/ux. The vulnerability was first published on May 29, 2026, and formally added to the GitHub Advisory Database on June 19, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (Github Advisory, Symfony Advisory).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): BatchActionController::__invoke() accepts an arbitrary-length actions array from the client and processes each entry by dispatching a full HttpKernel sub-request — triggering event subscribers, validators, Doctrine ORM operations, and template rendering — with no upper bound enforced on the number of actions. An authenticated attacker can craft a single HTTP POST to the /_components/<name>/_batch endpoint with a JSON payload containing thousands of action entries, causing the server to process each one sequentially and exhaust available CPU, memory, and database connections. No special privileges beyond a valid authenticated session are required, and no user interaction is needed (Github Advisory, Patch Commit).

Successful exploitation results in a denial of service affecting the application server's availability — exhausting CPU cycles, memory, and database connection pools, which can render the entire Symfony application unresponsive to legitimate users. There is no confidentiality or integrity impact; the vulnerability is purely an availability concern. Because database connections are shared across the application, a sustained attack could cascade to affect other services or components relying on the same database pool (Github Advisory, Symfony Advisory).

1. Authenticate: Obtain valid credentials for the target Symfony application using any available authentication method (e.g., registered user account, stolen session token).
2. Identify the batch endpoint: Locate a Live Component on the application that uses the _batch action endpoint, typically accessible at /_components/<component_name>/_batch via HTTP POST.
3. Retrieve component props: Make a normal request to the Live Component to capture the current props and data-live-props-value values needed to construct a valid batch request.
4. Craft the malicious payload: Construct a JSON body with an actions array containing thousands of entries, e.g.:

{
  "props": { ... },
  "actions": [
    {"name": "someAction", "args": {}},
    {"name": "someAction", "args": {}},
    ... (repeated thousands of times)
  ]
}

5. Submit the request: POST the crafted payload to /_components/<component_name>/_batch with appropriate headers (e.g., Content-Type: application/x-www-form-urlencoded with data=<json>).
6. Repeat for sustained DoS: Send multiple such requests in parallel or succession to maintain resource exhaustion and prevent server recovery (Github Advisory, Patch Commit).

• Network: Unusual high-volume or repeated HTTP POST requests to /_components/<name>/_batch endpoints from a single authenticated session or IP address; requests with abnormally large JSON payloads in the data parameter.
• Logs: Symfony/application logs showing a high number of HttpKernel sub-requests originating from a single _batch controller invocation; elevated response times or timeouts on batch endpoints; BadRequestHttpException: Too many actions in batch. errors (on patched versions, indicating attempted exploitation).
• Application Metrics: Sudden spikes in CPU utilization, memory consumption, or database connection pool exhaustion coinciding with requests to /_batch endpoints.
• Process: Database connection pool saturation or query queue buildup triggered by a single web request process (Github Advisory).

Upgrade symfony/ux-live-component to version 2.36.0 (for the 2.x branch) or 3.1.0 (for the 3.x branch), which enforce a hard cap of MAX_ACTIONS_PER_BATCH = 50 actions per _batch request and reject larger payloads with a BadRequestHttpException (Symfony Advisory, v2.36.0 Release, v3.1.0 Release). The JavaScript frontend was also updated to automatically split client-side batches exceeding 50 actions into sequential requests, so legitimate use cases are unaffected. As a temporary workaround prior to patching, implement WAF or reverse proxy rules to limit the size of POST request bodies to /_batch endpoints, and apply rate limiting on authenticated batch requests.

The vulnerability was reported by Pascal Cescon (GitHub: Amoifr) and fixed by Hugo Alliaume (GitHub: Kocal), both credited in the official advisory (Github Advisory). The fix was released as part of a broader security release (v2.36.0 / v3.1.0) that addressed five additional CVEs in the Symfony UX ecosystem simultaneously, suggesting a coordinated security audit of the package (v2.36.0 Release). No significant broader media coverage or notable community controversy has been observed for this specific CVE.