CVE-2026-109449Symfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process
Updated under an hour ago ()
Does this affect you?
It affects sensiolabs symfony. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.52%, higher than 43% of scored CVEs.
Do this next
Free account, 1 product
In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed. #[Assert\ExpressionSyntax] passes the validated value to ExpressionLanguage::lint(), so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions. This issue affects symfony/expression-language through v5.4.53, v6.0.0-BETA1 through v6.4.47, v7.0.0-BETA1 through v7.4.20, and v8.0.0-BETA1 through v8.1.8.
- CVSS
- 8.7 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Weakness (CWE)
- CWE-674
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.52% (percentile 43)
- Assigned by
- Checkmarx
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
sensiolabs symfony sensiolabs:symfony (from the name) | before v5.4.54; from v6.0.0-BETA1 before v6.4.48; from v7.0.0-BETA1 before v7.4.21; from v8.0.0-BETA1 before v8.1.9 | CNA record |
References
- https://github.com/symfony/symfony/security/advisories/GHSA-7rpj-w9pf-39rrthird-party-advisory
- https://symfony.com/blog/cve-2026-109449-unbounded-nesting-in-the-expression-parser-lets-untrusted-expressions-crash-the-processvendor-advisory
- https://github.com/symfony/symfony/pull/65690patch
- https://github.com/symfony/symfony/pull/66720patch
- https://github.com/symfony/symfony/pull/66723patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.