#[Assert\ExpressionSyntax] passes the validated value to ExpressionLanguage::lint(), so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions.
This issue affects symfony/expression-language through v5.4.53, v6.0.0-BETA1 through v6.4.47, v7.0.0-BETA1 through v7.4.20, and v8.0.0-BETA1 through v8.1.8.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| sensiolabs | symfony | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Thu, 15 Oct 2026 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed. #[Assert\ExpressionSyntax] passes the validated value to ExpressionLanguage::lint(), so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions. This issue affects symfony/expression-language through v5.4.53, v6.0.0-BETA1 through v6.4.47, v7.0.0-BETA1 through v7.4.20, and v8.0.0-BETA1 through v8.1.8. | |
| Title | Symfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process | |
| First Time appeared |
Sensiolabs
Sensiolabs symfony |
|
| Weaknesses | CWE-674 | |
| CPEs | cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Sensiolabs
Sensiolabs symfony |
|
| References |
|
|
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: Checkmarx
Published:
Updated: 2026-10-15T15:30:42.730Z
Reserved: 2026-10-12T16:57:32.590Z
Link: CVE-2026-109449
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-15T16:17:43.963
Modified: 2026-10-15T16:17:43.963
Link: CVE-2026-109449
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-674
Uncontrolled Recursion