CVE-2026-109449
Last modified
CVE-2026-109449 is a high-severity vulnerability rated 8.7/10 on the CVSS scale. In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed. #[Assert\ExpressionSyntax] passes the validated value to ExpressionLanguage::lint(), so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions. This issue affects symfony/expression-language through v5.4.53, v6.0.0-BETA1 through v6.4.47, v7.0.0-BETA1 through v7.4.20, and v8.0.0-BETA1 through v8.1.8..
Description
In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed. #[Assert\ExpressionSyntax] passes the validated value to ExpressionLanguage::lint(), so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions. This issue affects symfony/expression-language through v5.4.53, v6.0.0-BETA1 through v6.4.47, v7.0.0-BETA1 through v7.4.20, and v8.0.0-BETA1 through v8.1.8.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| sensiolabs | symfony | < v5.4.54; >= v6.0.0-BETA1, < v6.4.48; >= v7.0.0-BETA1, < v7.4.21; >= v8.0.0-BETA1, < v8.1.9 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-109449?
How severe is CVE-2026-109449?
How do I fix CVE-2026-109449?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-10943Use after free in WebRTC in Google Chrome prior to 149.0.782…8.8
- CVE-2026-109430Ellucian WebAdvisor 3.2 contains an unauthenticated XML Exte…7.5
- CVE-2026-1094383proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, co…5.3
- CVE-2026-109439Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware …9.8
- CVE-2026-10944Insufficient policy enforcement in Autofill in Google Chrome…6.5
- CVE-2026-109448Integer wraparound in psqlODBC SQLBindParameter allows an ap…5.9
- CVE-2026-10945Use after free in PDF in Google Chrome prior to 149.0.7827.5…8.8
- CVE-2026-109453Heap-based buffer overflow in Virtual Hard Disk (VHD) Minipo…7
- CVE-2026-10946Heap buffer overflow in Media in Google Chrome prior to 149.…7.5
- CVE-2026-10947Use after free in WebRTC in Google Chrome prior to 149.0.782…8.8
- CVE-2026-10948Use after free in WebRTC in Google Chrome prior to 149.0.782…8.8
- CVE-2026-10949Heap buffer overflow in Video in Google Chrome prior to 149.…8.3
Are you affected by CVE-2026-109449?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST