AIKIDO-2026-10868
symfony/yaml is vulnerable to Regular Expression Denial of Service (ReDoS)
37
Low Risk
This Affects:
symfony/yamlTL;DR
Parser::cleanup() uses regular expressions with overlapping quantifiers while stripping YAML directives and markers. Crafted leading YAML content can trigger catastrophic backtracking. Pre-fix applications that parse untrusted YAML can spend excessive CPU during cleanup. The fix rewrites the cleanup expressions with unambiguous, non-backtracking patterns.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
symfony/yaml is vulnerable to Regular Expression Denial of Service (ReDoS) in versions 0.0.1 - 5.4.51, 6.0.0 - 6.4.39, 7.0.0 - 7.4.11 and 8.0.0 - 8.0.11.
How to fix this
Upgrade the symfony/yaml and/or symfony/symfony library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant