Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
`Yaml\Parser::lexInlineStructure()` recursed through `lexInlineMapping()` and `lexInlineSequence()` for every `{` and `[` of an inline collection, without entering the nesting level that the rest of the parser bounds with `maxNestingLevel`. A document made of deeply nested inline collections, such as `[[[[...]]]]`, exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error. Any code parsing untrusted YAML is affected. That includes `#[MapRequestPayload]` when the Yaml component is installed and the endpoint does not restrict `acceptFormat`: a single unauthenticated request with a YAML content type is enough. Resolution The inline lexer now enters and leaves the same nesting level as the rest of the parser, so nested inline collections are bounded by `maxNestingLevel`, and the parser raises a `ParseException` beyond it. The patches for this issue are available…
Recommended action: Upgrade to 8.1.6, 7.4.18, 6.4.45 or 5.4.54 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Symfony\Component\Yaml\Parser::cleanup() strips the optional %YAML directive header, leading comments, and document start/end markers before parsing. The original regexes contained overlapping quantifiers, most notably '#^%YAML[: ][\d.]+.\n#u', whose [\d.]+ and . overlap on the dot, that exhibit catastrophic backtracking on crafted input. A single oversized %YAML directive header (or comment / document-marker line) makes the parser hang for an arbitrarily long time, denying service. Resolution The four regexes in Parser::cleanup() (YAML directive header, leading comments, document-start marker, document-end marker) have been rewritten with possessive quantifiers and unambiguous character classes so backtracking cannot occur. The patch for this issue is available here for branch 5.4. Credits Symfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it.
Recommended action: Upgrade to 8.0.12, 7.4.12, 6.4.40 or 5.4.52 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Symfony\Component\Yaml\Parser resolves YAML aliases (anchor) during parsing. Aliases that reference collections (arrays, stdClass, TaggedValue-wrapped collections) can themselves point to other collections containing aliases, creating exponential expansion at resolution time. A small input can blow up into a multi-gigabyte structure and exhaust memory: the classic "Billion Laughs" denial-of-service against any parser exposed to untrusted YAML. Resolution The Parser now counts collection alias resolutions in a shared ParserState object, with a default limit of 128, following the SnakeYAML model. Scalar aliases remain unrestricted since they cannot drive exponential growth. The limit is configurable via a new $maxAliasesForCollections argument on Parser::construct(), Yaml::parse() and Yaml::parseFile(). A new Yaml::PARSEEXCEPTIONONALIAS flag also rejects all aliases outright when parsing fully untrusted input. The patch for this issue is available here for branch 5.4.…
Recommended action: Upgrade to 8.0.12, 7.4.12, 6.4.40 or 5.4.52 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Symfony\Component\Yaml\Parser is the entry point for parsing YAML strings into PHP values via Yaml::parse(). When the parser is exposed to attacker-controlled input, deeply nested mappings or sequences cause both the block-level (Parser::parseBlock()) and inline (Inline::parseSequence() / Inline::parseMapping()) parsers to recurse without a depth limit. A crafted document exhausts the PHP stack and crashes the worker. Resolution The Parser now tracks recursion depth in a shared ParserState object across both block-level and inline parsing, with a default limit of 128. The limit is configurable via a new $maxNestingLevel argument on Parser::construct(), Yaml::parse() and Yaml::parseFile(). The patch for this issue is available here for branch 5.4. Credits Symfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it.
Recommended action: Upgrade to 8.0.12, 7.4.12, 6.4.40 or 5.4.52 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Yaml::parse function in Symfony 2.0.x before 2.0.22 remote attackers to execute arbitrary PHP code via a PHP file, a different vulnerability than CVE-2013-1397.
Recommended action: Upgrade to 2.0.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Symfony 2.0.x before 2.0.22, 2.1.x before 2.1.7, and 2.2.x remote attackers to execute arbitrary PHP code via a serialized PHP object to the (1) Yaml::parse or (2) Yaml\Parser::parse function, a different vulnerability than CVE-2013-1348.
Recommended action: Upgrade to 2.2.0-BETA2 (pre-release), 2.1.7 or 2.0.22 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.