## Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process

- 種別: advisory
- 重大度: high
- 関連技術: php, symfony
- CVE: CVE-2026-109413
- 公開日時: 2026-10-27T19:01:50.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-2v3c-qxhr-7vpv)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-2v3c-qxhr-7vpv

影響: composer:symfony/symfony >= 2.0.0, < 5.4.54 → 5.4.54, composer:symfony/symfony >= 6.0.0, < 6.4.45 → 6.4.45, composer:symfony/symfony >= 7.0.0, < 7.4.18 → 7.4.18, composer:symfony/symfony >= 8.0.0, < 8.1.6 → 8.1.6, composer:symfony/yaml >= 2.0.0, < 5.4.54 → 5.4.54, composer:symfony/yaml >= 6.0.0, < 6.4.45 → 6.4.45, composer:symfony/yaml >= 7.0.0, < 7.4.18 → 7.4.18, composer:symfony/yaml >= 8.0.0, < 8.1.6 → 8.1.6
Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A document made of deeply nested inline collections, such as [[[[...]]]], exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error. Any code parsing untrusted YAML is a…