Unbounded Nesting Vulnerability in Symfony Expression Language Component

CVE-2026-109449

What is CVE-2026-109449?

The Symfony Expression Language component prior to specific versions features an unbounded nesting vulnerability in its parser. This flaw allows a crafted expression comprised of numerous nested unary operators, array literals, and property accesses to lead to a severe denial-of-service condition. When processed, such expressions can cause the PHP process to crash as it attempts to manage excessive node depth during execution. Consequently, applications leveraging this component to validate user-defined expressions are at risk, potentially enabling adversaries to compromise runtime stability.

References