All vulnerabilities
CVE-2026-109449GHSA-7rpj-w9pf-39rr

Symfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process

sensiolabs symfonyFrameworks
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.52%Chance of exploitation activity in the next 30 days, higher than 43% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.4.54Also 6.4.48, 7.4.21 and 1 moreGitHub
Published15 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

  • 5.4.54symfony/expression-language, composerGitHubcomposer require "symfony/expression-language:^5.4.54"
  • 6.4.48symfony/expression-language, composerGitHubcomposer require "symfony/expression-language:^6.4.48"
  • 7.4.21symfony/expression-language, composerGitHubcomposer require "symfony/expression-language:^7.4.21"
  • 8.1.9symfony/expression-language, composerGitHubcomposer require "symfony/expression-language:^8.1.9"
  • 5.4.54symfony/symfony, composerGitHubcomposer require "symfony/symfony:^5.4.54"
  • 6.4.48symfony/symfony, composerGitHubcomposer require "symfony/symfony:^6.4.48"
Show all 8 fixed versions
  • 7.4.21symfony/symfony, composerGitHubcomposer require "symfony/symfony:^7.4.21"
  • 8.1.9symfony/symfony, composerGitHubcomposer require "symfony/symfony:^8.1.9"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed.

#[Assert\ExpressionSyntax] passes the validated value to ExpressionLanguage::lint(), so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions.

This issue affects symfony/expression-language through v5.4.53, v6.0.0-BETA1 through v6.4.47, v7.0.0-BETA1 through v7.4.20, and v8.0.0-BETA1 through v8.1.8.

Text from GitHub Advisory Database

Affected versions 12

  • symfonyaffected: all versions before v5.4.54CVE List
  • symfonyaffected: v6.0.0-BETA1 before v6.4.48CVE List
  • symfonyaffected: v7.0.0-BETA1 before v7.4.21CVE List
  • symfonyaffected: v8.0.0-BETA1 before v8.1.9CVE List
  • symfony/expression-language, composer<5.4.54GitHub
  • symfony/expression-language, composer>=6, <6.4.48GitHub
  • symfony/expression-language, composer>=7, <7.4.21GitHub
  • symfony/expression-language, composer>=8, <8.1.9GitHub
  • symfony/symfony, composer<5.4.54GitHub
  • symfony/symfony, composer>=6, <6.4.48GitHub
  • symfony/symfony, composer>=7, <7.4.21GitHub
  • symfony/symfony, composer>=8, <8.1.9GitHub

References 5