AIKIDO-2026-10867
symfony/yaml is vulnerable to Resource Exhaustion
37
Low Risk
This Affects:
symfony/yamlTL;DR
Parser resolves YAML aliases recursively, including aliases that point to collections containing further aliases. A small crafted YAML document can expand into a very large PHP structure. Pre-fix applications that parse untrusted YAML can exhaust memory through collection-alias expansion. The fix counts collection alias resolutions and adds a configurable limit.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
symfony/yaml is vulnerable to Resource Exhaustion in versions 0.0.1 - 5.4.51, 6.0.0 - 6.4.39, 7.0.0 - 7.4.11 and 8.0.0 - 8.0.11.
How to fix this
Upgrade the symfony/yaml and/or symfony/symfony library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant