Stack Exhaustion Vulnerability in Symfony YAML Parser

CVE-2026-109413

What is CVE-2026-109413?

The Symfony YAML parser is susceptible to a stack exhaustion vulnerability when processing deeply nested inline collections. In certain situations, requests containing deeply structured YAML can lead to stack exhaustion, causing crashes or fatal errors during the lexing process. This vulnerability impacts any code parsing untrusted YAML input, particularly affecting instances where the Yaml component is used without proper validation on the input structure. Invalid requests can be sent using a single unauthenticated request with a YAML content type, emphasizing the need for developers to employ strict controls and validations when handling YAML data.

References