Symfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process
In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed. #[Assert\ExpressionSyntax] passes the validated value to ExpressionLanguage::lint(), so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions. This issue affects symfony/expression-language through v5.4.53, v6.0.0-BETA1 through v6.4.47, v7.0.0-BETA1 through v7.4.20, and v8.0.0-BETA1 through v8.1.8.
CVE-2026-109449
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-109449
symfony
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/symfony/expression-language",
"vendor": "sensiolabs",
"modules": [
"ExpressionLanguage::lint()"
],
"product": "symfony",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "v5.4.54",
"versionType": "git"
},
{
"status": "affected",
"version": "v6.0.0-BETA1",
"lessThan": "v6.4.48",
"versionType": "git"
},
{
"status": "affected",
"version": "v7.0.0-BETA1",
"lessThan": "v7.4.21",
"versionType": "git"
},
{
"status": "affected",
"version": "v8.0.0-BETA1",
"lessThan": "v8.1.9",
"versionType": "git"
}
],
"packageName": "symfony/expression-language",
"collectionURL": "https://packagist.org/packages/symfony/expression-language",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-109449
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #29970 · Revision 1
- Added to Heist Feed
- Publisher date