Update dependency symfony/yaml to v6.4.40 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
symfony/yaml (source)	6.4.8 → 6.4.40

---

Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")

CVE-2026-45304 / GHSA-4qpc-3hr4-r2p4

More information

Details

Description

Symfony\Component\Yaml\Parser resolves YAML aliases (*anchor) during parsing. Aliases that reference collections (arrays, stdClass, TaggedValue-wrapped collections) can themselves point to other collections containing aliases, creating exponential expansion at resolution time. A small input can blow up into a multi-gigabyte structure and exhaust memory: the classic "Billion Laughs" denial-of-service against any parser exposed to untrusted YAML.

Resolution

The Parser now counts collection alias resolutions in a shared ParserState object, with a default limit of 128, following the SnakeYAML model. Scalar aliases remain unrestricted since they cannot drive exponential growth. The limit is configurable via a new $maxAliasesForCollections argument on Parser::__construct(), Yaml::parse() and Yaml::parseFile(). A new Yaml::PARSE_EXCEPTION_ON_ALIAS flag also rejects all aliases outright when parsing fully untrusted input.

The patch for this issue is available here for branch 5.4.

Credits

Symfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it.

Severity

• CVSS Score: 2.7 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

• https://github.com/symfony/symfony/security/advisories/GHSA-4qpc-3hr4-r2p4
• https://github.com/symfony/symfony/commit/e77391b2e4f18821198f010d573674c8ed4a970a
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45304.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/yaml/CVE-2026-45304.yaml
• https://symfony.com/cve-2026-45304
• https://github.com/advisories/GHSA-4qpc-3hr4-r2p4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Symfony hardened the parser when handling untrusted input

CVE-2026-45133 / GHSA-c2p3-7m5p-cv8x

More information

Details

Description

Symfony\Component\Yaml\Parser is the entry point for parsing YAML strings into PHP values via Yaml::parse(). When the parser is exposed to attacker-controlled input, deeply nested mappings or sequences cause both the block-level (Parser::parseBlock()) and inline (Inline::parseSequence() / Inline::parseMapping()) parsers to recurse without a depth limit. A crafted document exhausts the PHP stack and crashes the worker.

Resolution

The Parser now tracks recursion depth in a shared ParserState object across both block-level and inline parsing, with a default limit of 128. The limit is configurable via a new $maxNestingLevel argument on Parser::__construct(), Yaml::parse() and Yaml::parseFile().

The patch for this issue is available here for branch 5.4.

Credits

Symfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it.

Severity

• CVSS Score: 2.7 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

• https://github.com/symfony/symfony/security/advisories/GHSA-c2p3-7m5p-cv8x
• https://github.com/symfony/symfony/commit/914f427ed9630ddb3904dafba763e53d9f133fe3
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45133.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/yaml/CVE-2026-45133.yaml
• https://symfony.com/cve-2026-45133
• https://github.com/advisories/GHSA-c2p3-7m5p-cv8x

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex

CVE-2026-45305 / GHSA-9frc-8383-795m

More information

Details

Description

Symfony\Component\Yaml\Parser::cleanup() strips the optional %YAML directive header, leading comments, and document start/end markers before parsing. The original regexes contained overlapping quantifiers, most notably '#^%YAML[: ][\d.]+.*\n#u', whose [\d.]+ and .* overlap on the dot, that exhibit catastrophic backtracking on crafted input. A single oversized %YAML directive header (or comment / document-marker line) makes the parser hang for an arbitrarily long time, denying service.

Resolution

The four regexes in Parser::cleanup() (YAML directive header, leading comments, document-start marker, document-end marker) have been rewritten with possessive quantifiers and unambiguous character classes so backtracking cannot occur.

The patch for this issue is available here for branch 5.4.

Credits

Symfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it.

Severity

• CVSS Score: 2.7 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

• https://github.com/symfony/symfony/security/advisories/GHSA-9frc-8383-795m
• https://github.com/symfony/symfony/commit/9749cd43c5e09b3735093623670b21b9d8a056cb
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45305.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/yaml/CVE-2026-45305.yaml
• https://symfony.com/cve-2026-45305
• https://github.com/advisories/GHSA-9frc-8383-795m

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

symfony/yaml (symfony/yaml)

v6.4.40

Compare Source

Changelog (symfony/yaml@v6.4.39...v6.4.40)

• security #cve-2026-45305 Harden the Parser::cleanup() regexes against catastrophic backtracking (@​nicolas-grekas)
• security #cve-2026-45304 Bound collection-alias resolution in the parser (@​nicolas-grekas)
• security #cve-2026-45133 Bound recursion depth in the parser (@​nicolas-grekas)

v6.4.39

Compare Source

Changelog (symfony/yaml@v6.4.38...v6.4.39)

• bug #​64196 Reject non-stringables when using "!!binary" (@​nicolas-grekas)

v6.4.38

Compare Source

Changelog (symfony/yaml@v6.4.34...v6.4.38)

• bug #​64119 fix flow collection drops &anchor and !!str &anchor items (@​ousamabenyounes)

v6.4.34

Compare Source

Changelog (symfony/yaml@v6.4.33...v6.4.34)

• bug #​57292 Fix parsing nested mappings in sequences (@​HypeMC)

v6.4.30

Compare Source

Changelog (symfony/yaml@v6.4.29...v6.4.30)

• bug symfony/symfony#62612 [Yaml] Fix regression handling blank lines in unquoted scalars (@​yoeunes)
• bug symfony/symfony#62409 [Yaml] Align unquoted multiline scalar parsing with spec for comments (@​yoeunes)
• bug symfony/symfony#62359 [Yaml] Fix parsing of unquoted multiline scalars with comments or blank lines (@​yoeunes)

v6.4.26

Compare Source

Changelog (symfony/yaml@v6.4.25...v6.4.26)

• bug symfony/symfony#61855 [DoctrineBridge][Yaml] don't cast strings exceeding the min/max int ranges (@​xabbuh)

v6.4.25

Compare Source

Changelog (symfony/yaml@v6.4.24...v6.4.25)

• bug symfony/symfony#61520 [Yaml] Fix scope resolution operator in flow mapping keys (@​MatTheCat)

v6.4.24

Compare Source

Changelog (symfony/yaml@v6.4.23...v6.4.24)

• no significant changes

v6.4.23

Compare Source

Changelog (symfony/yaml@v6.4.22...v6.4.23)

• bug symfony/symfony#60648 [Yaml] fix support for years outside of the 32b range on x86 arch on PHP 8.4 (@​nicolas-grekas)

v6.4.21

Compare Source

Changelog (symfony/yaml@v6.4.20...v6.4.21)

• no significant changes

v6.4.20

Compare Source

Changelog (symfony/yaml@v6.4.19...v6.4.20)

• bug symfony/symfony#59830 [Yaml] drop comments while lexing unquoted strings (@​xabbuh)

v6.4.18

Compare Source

Changelog (symfony/yaml@v6.4.17...v6.4.18)

• bug symfony/symfony#59381 [Yaml] fix inline notation with inline comment (@​alexpott)
• bug symfony/symfony#59349 [Yaml] reject inline notations followed by invalid content (@​xabbuh)
• bug symfony/symfony#59312 [Yaml] Fix parsing of unquoted strings in Parser::lexUnquotedString() to ignore spaces (@​Link1515)

v6.4.13

Compare Source

Changelog (symfony/yaml@v6.4.12...v6.4.13)

• no significant changes

v6.4.12

Compare Source

Changelog (symfony/yaml@v6.4.11...v6.4.12)

• bug symfony/symfony#58279 [Yaml] parse empty sequence elements as null (@​xabbuh)

v6.4.11

Compare Source

Changelog (symfony/yaml@v6.4.10...v6.4.11)

• bug symfony/symfony#57968 [Yaml] 🐛 throw ParseException on invalid date (@​homersimpsons)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.