Skip to content

Navigation Menu

Sign in
Sign up

Update dependency symfony/yaml to 5.4.* [SECURITY] - #36

Open
renovate[bot] wants to merge 1 commit into
main from
renovate/packagist-symfony-yaml-vulnerability
Open

Update dependency symfony/yaml to 5.4.* [SECURITY] #36
renovate[bot] wants to merge 1 commit into
main from
renovate/packagist-symfony-yaml-vulnerability

Conversation

@renovate

@renovate renovate Bot commented May 30, 2026 •
edited
Loading

Copy link
Copy Markdown

This PR contains the following updates:

Package Change Age Confidence
symfony/yaml (source) 5.2.* → 5.4.* age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Symfony hardened the parser when handling untrusted input

CVE-2026-45133 / GHSA-c2p3-7m5p-cv8x

More information

Details

Description

Symfony\Component\Yaml\Parser is the entry point for parsing YAML strings into PHP values via Yaml::parse(). When the parser is exposed to attacker-controlled input, deeply nested mappings or sequences cause both the block-level (Parser::parseBlock()) and inline (Inline::parseSequence() / Inline::parseMapping()) parsers to recurse without a depth limit. A crafted document exhausts the PHP stack and crashes the worker.

Resolution

The Parser now tracks recursion depth in a shared ParserState object across both block-level and inline parsing, with a default limit of 128. The limit is configurable via a new $maxNestingLevel argument on Parser::__construct(), Yaml::parse() and Yaml::parseFile().

The patch for this issue is available here for branch 5.4.

Credits

Symfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it.

Severity

  • CVSS Score: 2.7 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")

CVE-2026-45304 / GHSA-4qpc-3hr4-r2p4

More information

Details

Description

Symfony\Component\Yaml\Parser resolves YAML aliases (*anchor) during parsing. Aliases that reference collections (arrays, stdClass, TaggedValue-wrapped collections) can themselves point to other collections containing aliases, creating exponential expansion at resolution time. A small input can blow up into a multi-gigabyte structure and exhaust memory: the classic "Billion Laughs" denial-of-service against any parser exposed to untrusted YAML.

Resolution

The Parser now counts collection alias resolutions in a shared ParserState object, with a default limit of 128, following the SnakeYAML model. Scalar aliases remain unrestricted since they cannot drive exponential growth. The limit is configurable via a new $maxAliasesForCollections argument on Parser::__construct(), Yaml::parse() and Yaml::parseFile(). A new Yaml::PARSE_EXCEPTION_ON_ALIAS flag also rejects all aliases outright when parsing fully untrusted input.

The patch for this issue is available here for branch 5.4.

Credits

Symfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it.

Severity

  • CVSS Score: 2.7 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex

CVE-2026-45305 / GHSA-9frc-8383-795m

More information

Details

Description

Symfony\Component\Yaml\Parser::cleanup() strips the optional %YAML directive header, leading comments, and document start/end markers before parsing. The original regexes contained overlapping quantifiers, most notably '#^%YAML[: ][\d.]+.*\n#u', whose [\d.]+ and .* overlap on the dot, that exhibit catastrophic backtracking on crafted input. A single oversized %YAML directive header (or comment / document-marker line) makes the parser hang for an arbitrarily long time, denying service.

Resolution

The four regexes in Parser::cleanup() (YAML directive header, leading comments, document-start marker, document-end marker) have been rewritten with possessive quantifiers and unambiguous character classes so backtracking cannot occur.

The patch for this issue is available here for branch 5.4.

Credits

Symfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it.

Severity

  • CVSS Score: 2.7 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

symfony/yaml (symfony/yaml)

v5.4.52

Compare Source

Changelog (symfony/yaml@v5.4.44...v5.4.52)

v5.4.45

Compare Source

Changelog (symfony/yaml@v5.4.44...v5.4.45)

  • no significant changes

v5.4.44

Compare Source

Changelog (symfony/yaml@v5.4.43...v5.4.44)

v5.4.43

Compare Source

Changelog (symfony/yaml@v5.4.42...v5.4.43)

v5.4.40

Compare Source

Changelog (symfony/yaml@v5.4.39...v5.4.40)

  • no significant changes

v5.4.39

Compare Source

Changelog (symfony/yaml@v5.4.38...v5.4.39)

v5.4.35

Compare Source

Changelog (symfony/yaml@v5.4.34...v5.4.35)

  • no significant changes

v5.4.31

Compare Source

Changelog (symfony/yaml@v5.4.30...v5.4.31)

v5.4.30

Compare Source

Changelog (symfony/yaml@v5.4.29...v5.4.30)

  • no significant changes

v5.4.23

Compare Source

Changelog (symfony/yaml@v5.4.22...v5.4.23)

  • bug #​50066 Trim leading newlines when checking if value begins with a space (bradtreloar)

v5.4.21

Compare Source

Changelog (symfony/yaml@v5.4.20...v5.4.21)

  • no significant changes

v5.4.19

Compare Source

Changelog (symfony/yaml@v5.4.18...v5.4.19)

  • no significant changes

v5.4.17

Compare Source

Changelog (symfony/yaml@v5.4.16...v5.4.17)

  • bug #​48331 fix dumping top-level tagged values (xabbuh)

v5.4.16

Compare Source

Changelog (symfony/yaml@v5.4.15...v5.4.16)

  • bug #​48333 parse unquoted digits in tag values as integers (xabbuh)

v5.4.14

Compare Source

Changelog (symfony/yaml@v5.4.13...v5.4.14)

  • no significant changes

v5.4.12

Compare Source

Changelog (symfony/yaml@v5.4.11...v5.4.12)

  • no significant changes

v5.4.11

Compare Source

Changelog (symfony/yaml@v5.4.10...v5.4.11)

  • no significant changes

v5.4.10

Compare Source

Changelog (symfony/yaml@v5.4.9...v5.4.10)

  • no significant changes

v5.4.3

Compare Source

Changelog (symfony/yaml@v5.4.2...v5.4.3)

  • bug #​45140 Making the parser stateless (mamazu)

v5.4.2

Compare Source

Changelog (symfony/yaml@v5.4.1...v5.4.2)

  • no significant changes

v5.4.0

Compare Source

Changelog (symfony/yaml@v5.4.0-RC1...v5.4.0)

  • no significant changes

v5.3.14

Compare Source

Changelog (symfony/yaml@v5.3.13...v5.3.14)

  • bug #​45140 Making the parser stateless (mamazu)

v5.3.13

Compare Source

Changelog (symfony/yaml@v5.3.12...v5.3.13)

  • no significant changes

v5.3.11

Compare Source

Changelog (symfony/yaml@v5.3.10...v5.3.11)

  • bug #​44131 properly parse quoted strings tagged with !!str (xabbuh)
  • bug #​44034 don't try to replace references in quoted strings (xabbuh)

v5.3.6

Compare Source

Changelog (symfony/yaml@v5.3.5...v5.3.6)

  • bug #​42296 Remove PHP 8.0 polyfill (derrabus)

v5.3.4

Compare Source

Changelog (symfony/yaml@v5.3.3...v5.3.4)

  • bug #​42074 Fix ctype_digit deprecation (alexpott)

v5.3.3

Compare Source

Changelog (symfony/yaml@v5.3.2...v5.3.3)

  • bug #​40857 Add support of PHP enumerations (alexandre-daubois)

v5.3.2

Compare Source

Changelog (symfony/yaml@v5.3.1...v5.3.2)

  • no significant changes

v5.3.0

Compare Source

Changelog (symfony/yaml@v5.3.0-RC1...v5.3.0)

  • bug #​41394 fix support for years outside of the 32b range on x86 arch (nicolas-grekas)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot requested a review from Clivern as a code owner May 30, 2026 11:51

renovate Bot commented May 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: composer.lock
Command failed: composer install --ignore-platform-req=ext-* --ignore-platform-req=lib-* --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins
Installing dependencies from lock file (including require-dev)
Verifying lock file contents can be installed on current platform.
Your lock file does not contain a compatible set of packages. Please run composer update.
 Problem 1
 - laminas/laminas-code is locked to version 4.4.2 and an update of this package was not requested.
 - laminas/laminas-code 4.4.2 requires php ^7.4 || ~8.0.0 -> your php version (8.5.9) does not satisfy that requirement.
 Problem 2
 - php-amqplib/php-amqplib is locked to version v2.12.3 and an update of this package was not requested.
 - php-amqplib/php-amqplib v2.12.3 requires php >=5.6.3,<8.0 -> your php version (8.5.9) does not satisfy that requirement.
 Problem 3
 - clivern/chunk is locked to version 2.0.1 and an update of this package was not requested.
 - clivern/chunk 2.0.1 requires php-amqplib/php-amqplib ^2.11 -> satisfiable by php-amqplib/php-amqplib[v2.12.3].
 - php-amqplib/php-amqplib v2.12.3 requires php >=5.6.3,<8.0 -> your php version (8.5.9) does not satisfy that requirement.

mergify Bot commented Jul 18, 2026

Copy link
Copy Markdown

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

  • Queue this pull request

1 similar comment

mergify Bot commented Aug 29, 2026

Copy link
Copy Markdown

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

  • Queue this pull request

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Clivern Clivern Awaiting requested review from Clivern Clivern is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

AltStyle によって変換されたページ (->オリジナル) /