p PatchFirst

CVE-2026-109449

CVE-2026-109449 · Symfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed. #[Assert\ExpressionSyntax] passes the validated value to ExpressionLanguage::lint(), so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions. This issue affects symfony/expression-language through v5.4.53, v6.0.0-BETA1 through v6.4.47, v7.0.0-BETA1 through v7.4.20, and v8.0.0-BETA1 through v8.1.8.

CVSS 8.7 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • symfony

    Versions
    • ≥ 0, < v5.4.54: Affected (git)
    • ≥ v6.0.0-BETA1, < v6.4.48: Affected (git)
    • ≥ v7.0.0-BETA1, < v7.4.21: Affected (git)
    • ≥ v8.0.0-BETA1, < v8.1.9: Affected (git)

    Update to v5.4.54; Update to v6.4.48; Update to v7.4.21; Update to v8.1.9

  • symfony Debian:12

    Versions
    • 5.4.23+dfsg-1
    • 5.4.23+dfsg-1+deb12u1
    • 5.4.23+dfsg-1+deb12u2
    • 5.4.23+dfsg-1+deb12u3
    • 5.4.23+dfsg-1+deb12u4
    • 5.4.23+dfsg-1+deb12u5
    • 5.4.24+dfsg-1
    • 5.4.25+dfsg-1
    • 5.4.27+dfsg-1
    • 5.4.28+dfsg-1
    • 5.4.29+dfsg-1
    • 5.4.30+dfsg-1
    • 5.4.31+dfsg-1
    • 5.4.31+dfsg-2
    • 5.4.32+dfsg-1
    • 5.4.33+dfsg-1
    • 5.4.34+dfsg-1
    • 5.4.34+dfsg-2
    • 5.4.35+dfsg-1
    • 5.4.35+dfsg-2
    • 5.4.35+dfsg-3
    • 5.4.52+dfsg-0+deb12u1
    • 5.4.53+dfsg-0+deb12u1
    • 6.3.0+dfsg-1
    • 6.3.0~rc1+dfsg-1
    • 6.3.0~rc2+dfsg-1
    • 6.3.1+dfsg-1
    • 6.3.3+dfsg-1
    • 6.3.4+dfsg-1
    • 6.3.5+dfsg-1
    • 6.3.6+dfsg-1
    • 6.3.7+dfsg-1
    • 6.4.0+dfsg-1
    • 6.4.0~beta2+dfsg-1
    • 6.4.0~beta3+dfsg-1
    • 6.4.0~rc1+dfsg-1
    • 6.4.0~rc2+dfsg-1
    • 6.4.1+dfsg-1
    • 6.4.10+dfsg-1
    • 6.4.11+dfsg-1
    • 6.4.12+dfsg-1
    • 6.4.13+dfsg-1
    • 6.4.14+dfsg-1
    • 6.4.15+dfsg-1
    • 6.4.16+dfsg-1
    • 6.4.16+dfsg-2
    • 6.4.17+dfsg-1
    • 6.4.17+dfsg-2
    • 6.4.17+dfsg-3
    • 6.4.17+dfsg-4
    • 6.4.17+dfsg-5
    • 6.4.17+dfsg-6
    • 6.4.18+dfsg-1
    • 6.4.19+dfsg-1
    • 6.4.19+dfsg-2
    • 6.4.2+dfsg-1
    • 6.4.20+dfsg-1
    • 6.4.20+dfsg-2
    • 6.4.21+dfsg-1
    • 6.4.21+dfsg-2
    • 6.4.24+dfsg-1
    • 6.4.25+dfsg-1
    • 6.4.3+dfsg-1
    • 6.4.4+dfsg-1
    • 6.4.4+dfsg-2
    • 6.4.4+dfsg-3
    • 6.4.4+dfsg-4
    • 6.4.5+dfsg-1
    • 6.4.5+dfsg-2
    • 6.4.5+dfsg-3
    • 6.4.5+dfsg-4
    • 6.4.6+dfsg-1
    • 6.4.7+dfsg-1
    • 6.4.9+dfsg-1
    • 7.0.4+dfsg-1
    • 7.0.5+dfsg-1
    • 7.0.6+dfsg-1
    • 7.0.7+dfsg-1
    • 7.1.0~beta1+dfsg-1
    • 7.1.0~rc1+dfsg-1
    • 7.1.2+dfsg-1
    • 7.1.3+dfsg-1
    • 7.1.4+dfsg-1
    • 7.1.5+dfsg-1
    • 7.2.0~beta1+dfsg-1
    • 7.2.0~beta2+dfsg-1
    • 7.2.0~rc1+dfsg-1
    • 7.2.1+dfsg-1
    • 7.2.2+dfsg-1
    • 7.2.3+dfsg-1
    • 7.2.4+dfsg-1
    • 7.2.5+dfsg-1
    • 7.2.6-1
    • 7.3.0+dfsg-1
    • 7.3.0~beta1+dfsg-1
    • 7.3.0~beta2+dfsg-1
    • 7.3.0~rc1+dfsg-1
    • 7.3.1+dfsg-1
    • 7.3.2+dfsg-1
    • 7.3.3+dfsg-1
    • 7.3.4+dfsg-1
    • 7.3.5-1
    • 7.4.0+dfsg-1
    • 7.4.0+dfsg-2
    • 7.4.0~beta1-1
    • 7.4.0~beta1-2
    • 7.4.0~beta2+dfsg-1
    • 7.4.0~beta2+dfsg-2
    • 7.4.0~beta2+dfsg-3
    • 7.4.0~rc1+dfsg-1
    • 7.4.0~rc2+dfsg-1
    • 7.4.0~rc3+dfsg-1
    • 7.4.10+dfsg-1
    • 7.4.12+dfsg-1
    • 7.4.13+dfsg-1
    • 7.4.13+dfsg-2
    • 7.4.14+dfsg-1
    • 7.4.15+dfsg-1
    • 7.4.15+dfsg-2
    • 7.4.16+dfsg-1
    • 7.4.17+dfsg-1
    • 7.4.18+dfsg-1
    • 7.4.19+dfsg-1
    • 7.4.2+dfsg-1
    • 7.4.2+dfsg-2
    • 7.4.20+dfsg-1
    • 7.4.21+dfsg-1
    • 7.4.3+dfsg-1
    • 7.4.4+dfsg-1
    • 7.4.5+dfsg-1
    • 7.4.6+dfsg-1
    • 7.4.6+dfsg-2
    • 7.4.7+dfsg-1
    • 7.4.8+dfsg-1
    • 7.4.9+dfsg-1
    • 8.0.0+dfsg-1
    • 8.0.0~beta2+dfsg-1
    • 8.0.0~beta2+dfsg-2
    • 8.0.0~rc1+dfsg-1
    • 8.0.0~rc2+dfsg-1
    • 8.0.0~rc3+dfsg-1
    • 8.0.10-1
    • 8.0.11+dfsg-1
    • 8.0.12+dfsg-1
    • 8.0.13+dfsg-1
    • 8.0.2+dfsg-1
    • 8.0.3+dfsg-1
    • 8.0.4+dfsg-1
    • 8.0.5+dfsg-1
    • 8.0.6+dfsg-1
    • 8.0.7+dfsg-1
    • 8.0.8+dfsg-1
    • 8.0.9+dfsg-1
    • 8.1.0+dfsg-1
    • 8.1.1+dfsg-1
    • 8.1.3+dfsg-1
    • 8.1.4+dfsg-1
    • 8.1.5+dfsg-1
    • 8.1.6+dfsg-1
    • 8.1.7+dfsg-1
    • 8.1.8+dfsg-1
    • 8.1.9+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Debian:13

    Versions
    • 6.4.21+dfsg-2
    • 6.4.21+dfsg-2+deb13u1
    • 6.4.24+dfsg-1
    • 6.4.25+dfsg-1
    • 6.4.40+dfsg-0+deb13u1
    • 6.4.41+dfsg-0+deb13u1
    • 7.0.4+dfsg-1
    • 7.0.5+dfsg-1
    • 7.0.6+dfsg-1
    • 7.0.7+dfsg-1
    • 7.1.0~beta1+dfsg-1
    • 7.1.0~rc1+dfsg-1
    • 7.1.2+dfsg-1
    • 7.1.3+dfsg-1
    • 7.1.4+dfsg-1
    • 7.1.5+dfsg-1
    • 7.2.0~beta1+dfsg-1
    • 7.2.0~beta2+dfsg-1
    • 7.2.0~rc1+dfsg-1
    • 7.2.1+dfsg-1
    • 7.2.2+dfsg-1
    • 7.2.3+dfsg-1
    • 7.2.4+dfsg-1
    • 7.2.5+dfsg-1
    • 7.2.6-1
    • 7.3.0+dfsg-1
    • 7.3.0~beta1+dfsg-1
    • 7.3.0~beta2+dfsg-1
    • 7.3.0~rc1+dfsg-1
    • 7.3.1+dfsg-1
    • 7.3.2+dfsg-1
    • 7.3.3+dfsg-1
    • 7.3.4+dfsg-1
    • 7.3.5-1
    • 7.4.0+dfsg-1
    • 7.4.0+dfsg-2
    • 7.4.0~beta1-1
    • 7.4.0~beta1-2
    • 7.4.0~beta2+dfsg-1
    • 7.4.0~beta2+dfsg-2
    • 7.4.0~beta2+dfsg-3
    • 7.4.0~rc1+dfsg-1
    • 7.4.0~rc2+dfsg-1
    • 7.4.0~rc3+dfsg-1
    • 7.4.10+dfsg-1
    • 7.4.12+dfsg-1
    • 7.4.13+dfsg-1
    • 7.4.13+dfsg-2
    • 7.4.14+dfsg-1
    • 7.4.15+dfsg-1
    • 7.4.15+dfsg-2
    • 7.4.16+dfsg-1
    • 7.4.17+dfsg-1
    • 7.4.18+dfsg-1
    • 7.4.19+dfsg-1
    • 7.4.2+dfsg-1
    • 7.4.2+dfsg-2
    • 7.4.20+dfsg-1
    • 7.4.21+dfsg-1
    • 7.4.3+dfsg-1
    • 7.4.4+dfsg-1
    • 7.4.5+dfsg-1
    • 7.4.6+dfsg-1
    • 7.4.6+dfsg-2
    • 7.4.7+dfsg-1
    • 7.4.8+dfsg-1
    • 7.4.9+dfsg-1
    • 8.0.0+dfsg-1
    • 8.0.0~beta2+dfsg-1
    • 8.0.0~beta2+dfsg-2
    • 8.0.0~rc1+dfsg-1
    • 8.0.0~rc2+dfsg-1
    • 8.0.0~rc3+dfsg-1
    • 8.0.10-1
    • 8.0.11+dfsg-1
    • 8.0.12+dfsg-1
    • 8.0.13+dfsg-1
    • 8.0.2+dfsg-1
    • 8.0.3+dfsg-1
    • 8.0.4+dfsg-1
    • 8.0.5+dfsg-1
    • 8.0.6+dfsg-1
    • 8.0.7+dfsg-1
    • 8.0.8+dfsg-1
    • 8.0.9+dfsg-1
    • 8.1.0+dfsg-1
    • 8.1.1+dfsg-1
    • 8.1.3+dfsg-1
    • 8.1.4+dfsg-1
    • 8.1.5+dfsg-1
    • 8.1.6+dfsg-1
    • 8.1.7+dfsg-1
    • 8.1.8+dfsg-1
    • 8.1.9+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Debian:14

    Versions
    • 6.4.21+dfsg-2
    • 6.4.24+dfsg-1
    • 6.4.25+dfsg-1
    • 7.0.4+dfsg-1
    • 7.0.5+dfsg-1
    • 7.0.6+dfsg-1
    • 7.0.7+dfsg-1
    • 7.1.0~beta1+dfsg-1
    • 7.1.0~rc1+dfsg-1
    • 7.1.2+dfsg-1
    • 7.1.3+dfsg-1
    • 7.1.4+dfsg-1
    • 7.1.5+dfsg-1
    • 7.2.0~beta1+dfsg-1
    • 7.2.0~beta2+dfsg-1
    • 7.2.0~rc1+dfsg-1
    • 7.2.1+dfsg-1
    • 7.2.2+dfsg-1
    • 7.2.3+dfsg-1
    • 7.2.4+dfsg-1
    • 7.2.5+dfsg-1
    • 7.2.6-1
    • 7.3.0+dfsg-1
    • 7.3.0~beta1+dfsg-1
    • 7.3.0~beta2+dfsg-1
    • 7.3.0~rc1+dfsg-1
    • 7.3.1+dfsg-1
    • 7.3.2+dfsg-1
    • 7.3.3+dfsg-1
    • 7.3.4+dfsg-1
    • 7.3.5-1
    • 7.4.0+dfsg-1
    • 7.4.0+dfsg-2
    • 7.4.0~beta1-1
    • 7.4.0~beta1-2
    • 7.4.0~beta2+dfsg-1
    • 7.4.0~beta2+dfsg-2
    • 7.4.0~beta2+dfsg-3
    • 7.4.0~rc1+dfsg-1
    • 7.4.0~rc2+dfsg-1
    • 7.4.0~rc3+dfsg-1
    • 7.4.10+dfsg-1
    • 7.4.12+dfsg-1
    • 7.4.13+dfsg-1
    • 7.4.13+dfsg-2
    • 7.4.14+dfsg-1
    • 7.4.15+dfsg-1
    • 7.4.15+dfsg-2
    • 7.4.16+dfsg-1
    • 7.4.17+dfsg-1
    • 7.4.18+dfsg-1
    • 7.4.19+dfsg-1
    • 7.4.2+dfsg-1
    • 7.4.2+dfsg-2
    • 7.4.20+dfsg-1
    • 7.4.3+dfsg-1
    • 7.4.4+dfsg-1
    • 7.4.5+dfsg-1
    • 7.4.6+dfsg-1
    • 7.4.6+dfsg-2
    • 7.4.7+dfsg-1
    • 7.4.8+dfsg-1
    • 7.4.9+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 7.4.21+dfsg-1

    Update to 7.4.21+dfsg-1

  • symfony Ubuntu:16.04:LTS

    Versions
    • 2.7.1+dfsg-1
    • 2.7.5+dfsg-1
    • 2.7.9+dfsg-1
    • 2.7.9+dfsg-1ubuntu2
    • 2.7.10-0ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:Pro:18.04:LTS

    Versions
    • 2.8.7+dfsg-1.3ubuntu1
    • 3.4.3+dfsg-1ubuntu4
    • 3.4.6+dfsg-1
    • 3.4.6+dfsg-1ubuntu0.1
    • 3.4.6+dfsg-1ubuntu0.1+esm1
    • 3.4.6+dfsg-1ubuntu0.1+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:Pro:20.04:LTS

    Versions
    • 4.3.4+dfsg-1ubuntu1
    • 4.3.8+dfsg-1ubuntu1
    • 4.3.8+dfsg-1ubuntu1+esm1
    • 4.3.8+dfsg-1ubuntu1+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:Pro:22.04:LTS

    Versions
    • 5.2.6+dfsg-1ubuntu7
    • 5.4.4+dfsg-1ubuntu8
    • 5.4.4+dfsg-1ubuntu8+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:Pro:24.04:LTS

    Versions
    • 5.4.23+dfsg-1ubuntu1
    • 5.4.35+dfsg-3ubuntu1
    • 6.4.5+dfsg-3ubuntu2
    • 6.4.5+dfsg-3ubuntu3
    • 6.4.5+dfsg-3ubuntu3+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:26.10

    Versions
    • 7.4.7+dfsg-1ubuntu1
    • 7.4.9+dfsg-1ubuntu1
    • 7.4.13+dfsg-2ubuntu1
    • 7.4.14+dfsg-1ubuntu2
    • 7.4.15+dfsg-2ubuntu2
    • 7.4.16+dfsg-1ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:26.04:LTS

    Versions
    • 6.4.24+dfsg-1
    • 7.4.5+dfsg-1ubuntu1
    • 7.4.6+dfsg-2ubuntu1
    • 7.4.7+dfsg-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →