CyberRota Analysis
AI-GeneratedThe vulnerability affects Symfony UX versions 2.5.0 to 2.36.0 and 3.1.0, allowing authenticated clients to submit an unbounded number of actions in a single batch request, potentially leading to resource exhaustion on the application server. This can result in degraded performance or service outages due to excessive CPU, memory, and database connection usage. Organizations using affected versions should prioritize applying the updates to versions 2.36.0 or 3.1.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke() iterates over the client-supplied actions array and issues a full HttpKernel sub-request for each entry; because the array size is never bounded, an authenticated client can submit a single _batch request containing thousands of actions and exhaust CPU, memory, and database connections on the application server. This issue is fixed in versions 2.36.0 and 3.1.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)