Low, CVSS 2.7PackagistPublished
Symfony's JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS
CVE-2026-45756 · GHSA-8v8v-g73j-492j
- Affected
- Packagist symfony/json-path >= 7.3.0, < 7.4.12; >= 8.0.0, < 8.0.12
- Fixed in
- 8.0.127.4.12· Vendor fix available
- Issue
- The JsonPath component's match() and search() filter functions compile a caller-supplied pattern straight into pregmatch(): transformJsonPathRegex() only performs cosmetic escaping: there is no length cap, no restriction to the RFC 9485 i-regexp subset, and no bound on backtracking. An application that evaluates an attacker-influenced JSONPath expression server-side (e.g. one taken from a query parameter or API field and passed to JsonCrawler) can therefore be made to run a catastrophic-backtracking pattern such as $[?search(@, "(a+)+$")]. Evaluated against a moderately sized document, this pins a CPU core for seconds per request, so a handful of concurrent requests exhausts the worker pool: a denial of service. Because the pregmatch() calls are prefixed with @, the PCRE backtrack-limit errors that would otherwise surface are suppressed, leaving no log trace. Conditions for exploitation An application that evaluates an attacker-influenced JSONPath expression containing a…
Recommended action: Upgrade to 8.0.12 or 7.4.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.