CyberRota Analysis
AI-GeneratedThe Symfony PHP framework is vulnerable to a denial-of-service attack due to an unbounded recursion issue in its parsers when processing deeply nested mappings or sequences from attacker-controlled input. This flaw can lead to PHP stack exhaustion, causing the application to crash. Organizations using affected versions should prioritize upgrading to the patched releases (5.4.52, 6.4.40, 7.4.12, or 8.0.12) to mitigate potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, when the parser is exposed to attacker-controlled input, deeply nested mappings or sequences cause both the block-level (Parser::parseBlock()) and inline (Inline::parseSequence() / Inline::parseMapping()) parsers to recurse without a depth limit. A crafted document exhausts the PHP stack and crashes the worker. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
Related CVEs
Other vulnerabilities affecting the same vendor(s)