Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process
High · fetched 2026-10-27
### Description `Yaml\Parser::lexInlineStructure()` recursed through `lexInlineMapping()` and `lexInlineSequence()` for every `{` and `[` of an inline collection, without entering the nesting level that the rest of the parser bounds with `maxNestingLevel`. A document made of deeply nested inline collections, such as `[[[[...]]]]`, exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error. Any code parsing untrusted YAML is affected.
Remediation
Upgrade symfony/symfony to 5.4.54 or later. Upgrade symfony/symfony to 6.4.45 or later. Upgrade symfony/symfony to 7.4.18 or later.
Affected PHP branches
See the source advisory.
Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-27T16:20:12-04:00 · https://github.com/advisories/GHSA-2v3c-qxhr-7vpv