Symfony YAML parser takes exponential time on crafted documents
One small YAML document can freeze a PHP web server for minutes.
Summary
The Symfony YAML parser takes exponentially or quadratically longer on crafted documents, so one small file can keep a PHP process busy for seconds or minutes. Any code parsing untrusted YAML in the affected versions is affected.
Affected when
- Any code parsing untrusted YAML
- Symfony 7.4 or later with the Yaml component installed, #[MapRequestPayload] used, and acceptFormat not restricted
What to do
Update to the patched version for your branch: 5.4.56, 6.4.50, 7.4.23, or 8.1.11.
Update to at least the version for your product:
- Symfony 5.4 5.4.56 or later
- Symfony 6.4 6.4.50 or later
- Symfony 7.4 7.4.23 or later
- Symfony 8.1 8.1.11 or later
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen