Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process

影響: composer:symfony/symfony >= 2.0.0, < 5.4.54 → 5.4.54, composer:symfony/symfony >= 6.0.0, < 6.4.45 → 6.4.45, composer:symfony/symfony >= 7.0.0, < 7.4.18 → 7.4.18, composer:symfony/symfony >= 8.0.0, < 8.1.6 → 8.1.6, composer:symfony/yaml >= 2.0.0, < 5.4.54 → 5.4.54, composer:symfony/yaml >= 6.0.0, < 6.4.45 → 6.4.45, composer:symfony/yaml >= 7.0.0, < 7.4.18 → 7.4.18, composer:symfony/yaml >= 8.0.0, < 8.1.6 → 8.1.6

Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A document made of deeply nested inline collections, such as [[[[...]]]], exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error. Any code parsing untrusted YAML is a…

GitHub Advisory Databaseで読む

2026/10/28 04:01、GitHub Advisory Databaseが「Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: PHP、Symfony。CVE: CVE-2026-109413。