CVE-2026-45304

Summary

Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")

Severity

low

Also known as

GHSA-4qpc-3hr4-r2p4#symfony/symfony, GHSA-4qpc-3hr4-r2p4#symfony/yaml

Published

2026-05-27

References

• https://github.com/symfony/symfony/security/advisories/GHSA-4qpc-3hr4-r2p4
• https://github.com/symfony/symfony/commit/e77391b2e4f18821198f010d573674c8ed4a970a
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45304.yaml

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity