Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process

影響: composer:symfony/symfony >= 2.0.0, < 5.4.54 → 5.4.54, composer:symfony/symfony >= 6.0.0, < 6.4.45 → 6.4.45, composer:symfony/symfony >= 7.0.0, < 7.4.18 → 7.4.18, composer:symfony/symfony >= 8.0.0, < 8.1.6 → 8.1.6, composer:symfony/yaml >= 2.0.0, < 5.4.54 → 5.4.54, composer:symfony/yaml >= 6.0.0, < 6.4.45 → 6.4.45, composer:symfony/yaml >= 7.0.0, < 7.4.18 → 7.4.18, composer:symfony/yaml >= 8.0.0, < 8.1.6 → 8.1.6

Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A document made of deeply nested inline collections, such as [[[[...]]]], exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error. Any code parsing untrusted YAML is a…

GitHub Advisory Database에서 읽기

2026. 10. 28. 오전 04:01, GitHub Advisory Database에서 "Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: PHP, Symfony. CVE: CVE-2026-109413.