CyberRota Analysis
AI-GeneratedThe JsonPath component of the Symfony PHP framework is vulnerable to denial of service due to the lack of safeguards when compiling attacker-controlled filter patterns, which can lead to catastrophic backtracking and excessive CPU usage. This vulnerability affects versions 7.3.0-BETA1 through 7.4.12 and 8.0.12, and should be prioritized by organizations using these versions in their web applications to mitigate potential service disruptions. Users are strongly advised to upgrade to the patched versions 7.4.12 or 8.0.12 to ensure protection against this high-severity issue.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.3.0-BETA1 until 7.4.12 and 8.0.12, the JsonPath component compiles attacker-controlled match() and search() filter patterns directly into preg_match() without a length cap, i-regexp restriction, or bounded backtracking, allowing catastrophic-backtracking expressions to pin worker CPU and cause denial of service. This issue is fixed in versions 7.4.12 and 8.0.12.
Related CVEs
Other vulnerabilities affecting the same vendor(s)