symfony/yaml-v8.0.1: 3 vulnerabilities (highest severity is: 7.5)

[mend-bolt-for-github]

Vulnerable Library - symfony/yaml-v8.0.1

Loads and dumps YAML files

Library home page: https://api.github.com/repos/symfony/yaml/zipball/7a1a90ba1df6e821a6b53c4cabdc32a56cabfb14

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (symfony/yaml-v8.0.1 version)	Remediation Possible**
CVE-2026-45305	High	7.5	symfony/yaml-v8.0.1	Direct	https://github.com/symfony/symfony.git - v5.4.52,https://github.com/symfony/symfony.git - v7.4.12,https://github.com/symfony/symfony.git - v6.4.40,https://github.com/symfony/symfony.git - v8.0.12	❌
CVE-2026-45304	High	7.5	symfony/yaml-v8.0.1	Direct	https://github.com/symfony/symfony.git - v5.4.52,https://github.com/symfony/symfony.git - v7.4.12,https://github.com/symfony/symfony.git - v8.0.12,https://github.com/symfony/symfony.git - v6.4.40	❌
CVE-2026-45133	High	7.5	symfony/yaml-v8.0.1	Direct	https://github.com/symfony/symfony.git - v6.4.39,https://github.com/symfony/symfony.git - v5.4.52,https://github.com/symfony/symfony.git - v7.4.11,https://github.com/symfony/symfony.git - v8.0.11	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-45305

Vulnerable Library - symfony/yaml-v8.0.1

Loads and dumps YAML files

Library home page: https://api.github.com/repos/symfony/yaml/zipball/7a1a90ba1df6e821a6b53c4cabdc32a56cabfb14

Dependency Hierarchy:

• ❌ symfony/yaml-v8.0.1 (Vulnerable Library)

Found in base branch: develop

Vulnerability Details

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser::cleanup() used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup, allowing crafted input to make parsing hang for an arbitrarily long time. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Publish Date: 2026-07-14

URL: CVE-2026-45305

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-05-27

Fix Resolution: https://github.com/symfony/symfony.git - v5.4.52,https://github.com/symfony/symfony.git - v7.4.12,https://github.com/symfony/symfony.git - v6.4.40,https://github.com/symfony/symfony.git - v8.0.12

Step up your Open Source Security Game with Mend here

CVE-2026-45304

Vulnerable Library - symfony/yaml-v8.0.1

Loads and dumps YAML files

Library home page: https://api.github.com/repos/symfony/yaml/zipball/7a1a90ba1df6e821a6b53c4cabdc32a56cabfb14

Dependency Hierarchy:

• ❌ symfony/yaml-v8.0.1 (Vulnerable Library)

Found in base branch: develop

Vulnerability Details

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser resolved YAML collection aliases recursively, allowing a small untrusted YAML input to expand into a multi-gigabyte structure and exhaust memory. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Publish Date: 2026-07-14

URL: CVE-2026-45304

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-05-27

Fix Resolution: https://github.com/symfony/symfony.git - v5.4.52,https://github.com/symfony/symfony.git - v7.4.12,https://github.com/symfony/symfony.git - v8.0.12,https://github.com/symfony/symfony.git - v6.4.40

Step up your Open Source Security Game with Mend here

CVE-2026-45133

Vulnerable Library - symfony/yaml-v8.0.1

Loads and dumps YAML files

Library home page: https://api.github.com/repos/symfony/yaml/zipball/7a1a90ba1df6e821a6b53c4cabdc32a56cabfb14

Dependency Hierarchy:

• ❌ symfony/yaml-v8.0.1 (Vulnerable Library)

Found in base branch: develop

Vulnerability Details

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, when the parser is exposed to attacker-controlled input, deeply nested mappings or sequences cause both the block-level (Parser::parseBlock()) and inline (Inline::parseSequence() / Inline::parseMapping()) parsers to recurse without a depth limit. A crafted document exhausts the PHP stack and crashes the worker. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Publish Date: 2026-07-14

URL: CVE-2026-45133

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-05-27

Fix Resolution: https://github.com/symfony/symfony.git - v6.4.39,https://github.com/symfony/symfony.git - v5.4.52,https://github.com/symfony/symfony.git - v7.4.11,https://github.com/symfony/symfony.git - v8.0.11

Step up your Open Source Security Game with Mend here