CVE-2026-109449 (GCVE-0-2026-109449)
Vulnerability from cvelistv5
Published
2026-10-15 15:19
Modified
2026-10-15 18:05
Severity ?
8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CWE
Summary
In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed. #[Assert\ExpressionSyntax] passes the validated value to ExpressionLanguage::lint(), so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions. This issue affects symfony/expression-language through v5.4.53, v6.0.0-BETA1 through v6.4.47, v7.0.0-BETA1 through v7.4.20, and v8.0.0-BETA1 through v8.1.8.
References
Impacted products
Vendor Product Version
sensiolabs symfony Version: 0
Version: v6.0.0-BETA1
Version: v7.0.0-BETA1
Version: v8.0.0-BETA1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109449",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T18:05:16.968511Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T18:05:32.422Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org/packages/symfony/expression-language",
          "defaultStatus": "unaffected",
          "modules": [
            "ExpressionLanguage::lint()"
          ],
          "packageName": "symfony/expression-language",
          "product": "symfony",
          "repo": "https://github.com/symfony/expression-language",
          "vendor": "sensiolabs",
          "versions": [
            {
              "lessThan": "v5.4.54",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            },
            {
              "lessThan": "v6.4.48",
              "status": "affected",
              "version": "v6.0.0-BETA1",
              "versionType": "git"
            },
            {
              "lessThan": "v7.4.21",
              "status": "affected",
              "version": "v7.0.0-BETA1",
              "versionType": "git"
            },
            {
              "lessThan": "v8.1.9",
              "status": "affected",
              "version": "v8.0.0-BETA1",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "v5.4.54",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "v6.4.48",
                  "versionStartIncluding": "v6.0.0-beta1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "v7.4.21",
                  "versionStartIncluding": "v7.0.0-beta1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "v8.1.9",
                  "versionStartIncluding": "v8.0.0-beta1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nicolas Grekas"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In\u0026nbsp;\u003cspan\u003eSymfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9,\u0026nbsp;\u003c/span\u003e\u003cspan\u003ethe parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed.\u003c/span\u003e\u003cdiv\u003e\u003ccode\u003e\u003cbr\u003e\u003c/code\u003e\u003c/div\u003e\u003cdiv\u003e\u003ccode\u003e#[Assert\\ExpressionSyntax]\u003c/code\u003e\u003cspan\u003e passes the validated value to \u003c/span\u003e\u003ccode\u003eExpressionLanguage::lint()\u003c/code\u003e\u003cspan\u003e, so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003eThis issue affects \u003c/span\u003e\u003ccode\u003esymfony/expression-language\u003c/code\u003e\u003cspan\u003e\u0026nbsp;through v5.4.53, v6.0.0-BETA1\u0026nbsp;\u003c/span\u003ethrough\u003cspan\u003e\u0026nbsp;v6.4.47, v7.0.0-BETA1\u0026nbsp;\u003c/span\u003ethrough\u003cspan\u003e\u0026nbsp;v7.4.20, and v8.0.0-BETA1\u0026nbsp;\u003c/span\u003ethrough\u003cspan\u003e\u0026nbsp;v8.1.8.\u003c/span\u003e\u003c/div\u003e"
            }
          ],
          "value": "In\u00a0Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9,\u00a0the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed.\n\n\n#[Assert\\ExpressionSyntax] passes the validated value to ExpressionLanguage::lint(), so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions.\n\nThis issue affects symfony/expression-language\u00a0through v5.4.53, v6.0.0-BETA1\u00a0through\u00a0v6.4.47, v7.0.0-BETA1\u00a0through\u00a0v7.4.20, and v8.0.0-BETA1\u00a0through\u00a0v8.1.8."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674 Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T15:30:42.730Z",
        "orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
        "shortName": "Checkmarx"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/symfony/symfony/security/advisories/GHSA-7rpj-w9pf-39rr"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://symfony.com/blog/cve-2026-109449-unbounded-nesting-in-the-expression-parser-lets-untrusted-expressions-crash-the-process"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/symfony/symfony/pull/65690"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/symfony/symfony/pull/66720"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/symfony/symfony/pull/66723"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Symfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
    "assignerShortName": "Checkmarx",
    "cveId": "CVE-2026-109449",
    "datePublished": "2026-10-15T15:19:08.663Z",
    "dateReserved": "2026-10-12T16:57:32.590Z",
    "dateUpdated": "2026-10-15T18:05:32.422Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-109449\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-15T18:05:16.968511Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-15T18:05:26.971Z\"}}], \"cna\": {\"title\": \"Symfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Nicolas Grekas\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 8.7, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/symfony/expression-language\", \"vendor\": \"sensiolabs\", \"modules\": [\"ExpressionLanguage::lint()\"], \"product\": \"symfony\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"v5.4.54\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"v6.0.0-BETA1\", \"lessThan\": \"v6.4.48\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"v7.0.0-BETA1\", \"lessThan\": \"v7.4.21\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"v8.0.0-BETA1\", \"lessThan\": \"v8.1.9\", \"versionType\": \"git\"}], \"packageName\": \"symfony/expression-language\", \"collectionURL\": \"https://packagist.org/packages/symfony/expression-language\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/symfony/symfony/security/advisories/GHSA-7rpj-w9pf-39rr\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://symfony.com/blog/cve-2026-109449-unbounded-nesting-in-the-expression-parser-lets-untrusted-expressions-crash-the-process\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://github.com/symfony/symfony/pull/65690\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/symfony/symfony/pull/66720\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/symfony/symfony/pull/66723\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.5\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In\\u00a0Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9,\\u00a0the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed.\\n\\n\\n#[Assert\\\\ExpressionSyntax] passes the validated value to ExpressionLanguage::lint(), so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions.\\n\\nThis issue affects symfony/expression-language\\u00a0through v5.4.53, v6.0.0-BETA1\\u00a0through\\u00a0v6.4.47, v7.0.0-BETA1\\u00a0through\\u00a0v7.4.20, and v8.0.0-BETA1\\u00a0through\\u00a0v8.1.8.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"In\u0026nbsp;\u003cspan\u003eSymfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9,\u0026nbsp;\u003c/span\u003e\u003cspan\u003ethe parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed.\u003c/span\u003e\u003cdiv\u003e\u003ccode\u003e\u003cbr\u003e\u003c/code\u003e\u003c/div\u003e\u003cdiv\u003e\u003ccode\u003e#[Assert\\\\ExpressionSyntax]\u003c/code\u003e\u003cspan\u003e passes the validated value to \u003c/span\u003e\u003ccode\u003eExpressionLanguage::lint()\u003c/code\u003e\u003cspan\u003e, so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003eThis issue affects \u003c/span\u003e\u003ccode\u003esymfony/expression-language\u003c/code\u003e\u003cspan\u003e\u0026nbsp;through v5.4.53, v6.0.0-BETA1\u0026nbsp;\u003c/span\u003ethrough\u003cspan\u003e\u0026nbsp;v6.4.47, v7.0.0-BETA1\u0026nbsp;\u003c/span\u003ethrough\u003cspan\u003e\u0026nbsp;v7.4.20, and v8.0.0-BETA1\u0026nbsp;\u003c/span\u003ethrough\u003cspan\u003e\u0026nbsp;v8.1.8.\u003c/span\u003e\u003c/div\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-674\", \"description\": \"CWE-674 Uncontrolled Recursion\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"v5.4.54\", \"versionStartIncluding\": \"0\"}, {\"criteria\": \"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"v6.4.48\", \"versionStartIncluding\": \"v6.0.0-beta1\"}, {\"criteria\": \"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"v7.4.21\", \"versionStartIncluding\": \"v7.0.0-beta1\"}, {\"criteria\": \"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"v8.1.9\", \"versionStartIncluding\": \"v8.0.0-beta1\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}], \"providerMetadata\": {\"orgId\": \"596c5446-0ce5-4ba2-aa66-48b3b757a647\", \"shortName\": \"Checkmarx\", \"dateUpdated\": \"2026-10-15T15:30:42.730Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-109449\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-15T18:05:32.422Z\", \"dateReserved\": \"2026-10-12T16:57:32.590Z\", \"assignerOrgId\": \"596c5446-0ce5-4ba2-aa66-48b3b757a647\", \"datePublished\": \"2026-10-15T15:19:08.663Z\", \"assignerShortName\": \"Checkmarx\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.