Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/symfony/yaml@6.4.40
purl pkg:composer/symfony/yaml@6.4.40
Next non-vulnerable version 6.4.45
Latest non-vulnerable version 8.1.6
Risk score 3.9
Vulnerabilities affecting this package (1)
Advisory Summary Fixed in package version
GHSA-2v3c-qxhr-7vpv
Aliases:
CVE-2026-109413
Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process ### Description `Yaml\Parser::lexInlineStructure()` recursed through …
6.4.45
Not vulnerable
Vulnerabilities fixed by this package (3)

Advisory Summary Aliases
GHSA-c2p3-7m5p-cv8x
Symfony hardened the parser when handling untrusted input ### Description `Symfony\Component\Yaml\Parser` is the entry point for parsing YAML strings into … CVE-2026-45133
GHSA-4qpc-3hr4-r2p4
Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs") ### Description `Symfony\Component\Yaml\Parser` resolves YAML aliases … CVE-2026-45304
GHSA-9frc-8383-795m
Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex ### Description `Symfony\Component\Yaml\Parser::cleanup()` strips the optional `%YAML` directive … CVE-2026-45305