Advisory details:
github_osv / GHSA-9frc-8383-795m
| Advisory ID | github_osv/GHSA-9frc-8383-795m |
| Aliases |
CVE-2026-45305
|
| Summary | Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex ### Description `Symfony\Component\Yaml\Parser::cleanup()` strips the optional `%YAML` directive header, leading comments, and document start/end markers before parsing. The original regexes contained overlapping quantifiers, most notably `'#^%YAML[: ][\d.]+.*\n#u'`, whose `[\d.]+` and `.*` overlap on the dot, that exhibit catastrophic backtracking on crafted input. A single oversized `%YAML` directive header (or comment / document-marker line) makes the parser hang for an arbitrarily long time, denying service. ### Resolution The four regexes in `Parser::cleanup()` (YAML directive header, leading comments, document-start marker, document-end marker) have been rewritten with possessive quantifiers and unambiguous character classes so backtracking cannot occur. The patch for this issue is available [here](https://github.com/symfony/symfony/commit/9749cd43c5e09b3735093623670b21b9d8a056cb) for branch 5.4. ### Credits Symfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 2.4 |
| Risk | 1.2 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv4 | 2.7 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-9frc-8383-795m/GHSA-9frc-8383-795m.json |
| generic_textual | LOW |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Attack Requirements (AT) | Privileges Required (PR) | User Interaction (UI) | Vulnerable System Impact Confidentiality (VC) | Vulnerable System Impact Integrity (VI) | Vulnerable System Impact Availability (VA) | Subsequent System Impact Confidentiality (SC) | Subsequent System Impact Integrity (SI) | Subsequent System Impact Availability (SA) |
|---|---|---|---|---|---|---|---|---|---|---|
network adjacent local physical |
low high |
none present |
none low high |
none passive active |
high low none |
high low none |
high low none |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-07-15T14:03:51Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/45xxx/CVE-2026-45305.json
Source Advisory: vulnrichment/CVE-2026-45305
[{'Exploitation': 'none'},
{'Automatable': 'yes'},
{'Technical Impact': 'partial'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]