Detections
Analytics

Symfony and Symfony YAML Component 2.0.x < 5.4.54 / 6.0.x < 6.4.45 / 7.0.x < 7.4.18 / 8.0.x < 8.1.6 DoS

high Nessus Plugin ID 373650

Synopsis

A PHP library installed on the remote host is affected by a denial of service vulnerability.

Description

The version of Symfony and/or the Symfony YAML Component installed on the remote host is 2.0.x prior to 5.4.54, or 6.0.x prior to 6.4.45, or 7.0.x prior to 7.4.18, or 8.0.x prior to 8.1.6. It is, therefore, affected by a denial of service vulnerability.

 - Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. An unauthenticated, remote attacker can exploit this, by submitting a YAML document made of deeply nested inline collections such as [[[[...]]]], to exhaust the stack while the document is being lexed, causing the process to crash or the request to end with a fatal error. Any code parsing untrusted YAML is affected, including endpoints using #[MapRequestPayload] that do not restrict acceptFormat. (CVE-2026-109413)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. Also note that this plugin does not distinguish between PHP packages installed via the OS package manager, PHP packages installed via Composer, or other sources. As a result, packages provided by your OS package repository may have backported fixes that this plugin may incorrectly report as vulnerable. Please refer to the OS-specific plugins for CVE-2026-109413 to check for backported fixes.

Solution

Upgrade Symfony and/or its affected Components to version 5.4.54, 6.4.45, 7.4.18, 8.1.6, or later.

See Also

https://github.com/advisories/GHSA-2v3c-qxhr-7vpv

https://github.com/symfony/symfony/pull/65688

https://symfony.com/cve-2026-109413

http://www.nessus.org/u?376812ef

Plugin Details

Severity: High

ID: 373650

File Name: symfony_yaml_GHSA-2v3c-qxhr-7vpv.nasl

Version: 1.2

Type: Local

Agent: windows, macosx, unix

Family: Misc.

Published: 10/29/2026

Updated: 10/30/2026

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.73

CVSS v2

Risk Factor: High

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-109413

CVSS v3

Risk Factor: High

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v4

Risk Factor: High

Base Score: 8.7

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/a:sensiolabs:symfony

Required KB Items: language_library/package/composer/enumerated

Patch Publication Date: 10/15/2026

Vulnerability Publication Date: 10/15/2026

Reference Information

CVE: CVE-2026-109413

CWE: 674

IAVB: 2026-B-0308