AIKIDO-2026-11073

TL;DR

Symfony UX LiveComponent's BatchActionController::__invoke() iterates over a client-supplied actions array and dispatches a separate HttpKernel sub-request for each entry without bounding the array length. An authenticated client can submit a batch payload with thousands of actions to exhaust CPU, memory, and database connections on the server. The fix introduces a MAX_ACTIONS_PER_BATCH cap of 50 and rejects oversized payloads with BadRequestHttpException, while the JavaScript client now splits larger batches across multiple requests.