CVE-2026-109449
8.7HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-674
Impact
Unauthenticated remote attackers can crash PHP processes by submitting deeply nested expressions to any endpoint that validates or parses user-supplied expressions. This causes a denial of service with a single request.
Root cause
The parser in the ExpressionLanguage component constructs node trees without recursion depth limits, triggering a process crash when freeing deeply nested syntax trees.
Affected systems
symfony/expression-language through 5.4.53, 6.0.0-BETA1 through 6.4.47, 7.0.0-BETA1 through 7.4.20, and 8.0.0-BETA1 through 8.1.8
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade symfony/expression-language to 5.4.54, 6.4.48, 7.4.21, or 8.1.9 or later. If patching immediately is not possible, reject or rate-limit user-supplied input containing excessive nested operators before passing it to ExpressionLanguage::lint() or #[Assert\ExpressionSyntax].
$ composer update symfony/expression-languageAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed. #[Assert\ExpressionSyntax] passes the validated value to ExpressionLanguage::lint(), so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions. This issue affects symfony/expression-language through v5.4.53, v6.0.0-BETA1 through v6.4.47, v7.0.0-BETA1 through v7.4.20, and v8.0.0-BETA1 through v8.1.8.
References
- https://github.com/symfony/symfony/pull/65690
- https://github.com/symfony/symfony/pull/66720
- https://github.com/symfony/symfony/pull/66723
- https://github.com/symfony/symfony/security/advisories/GHSA-7rpj-w9pf-39rr
- https://symfony.com/blog/cve-2026-109449-unbounded-nesting-in-the-expression-parser-lets-untrusted-expressions-crash-the-process