Update dependency symfony/yaml to 5.4.* [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
symfony/yaml (source)	5.2.* → 5.4.*

---

Symfony hardened the parser when handling untrusted input

CVE-2026-45133 / GHSA-c2p3-7m5p-cv8x

More information

Details

Description

Symfony\Component\Yaml\Parser is the entry point for parsing YAML strings into PHP values via Yaml::parse(). When the parser is exposed to attacker-controlled input, deeply nested mappings or sequences cause both the block-level (Parser::parseBlock()) and inline (Inline::parseSequence() / Inline::parseMapping()) parsers to recurse without a depth limit. A crafted document exhausts the PHP stack and crashes the worker.

Resolution

The Parser now tracks recursion depth in a shared ParserState object across both block-level and inline parsing, with a default limit of 128. The limit is configurable via a new $maxNestingLevel argument on Parser::__construct(), Yaml::parse() and Yaml::parseFile().

The patch for this issue is available here for branch 5.4.

Credits

Symfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it.

Severity

• CVSS Score: 2.7 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

• https://github.com/symfony/symfony/security/advisories/GHSA-c2p3-7m5p-cv8x
• https://github.com/symfony/symfony/commit/914f427ed9630ddb3904dafba763e53d9f133fe3
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45133.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/yaml/CVE-2026-45133.yaml
• https://symfony.com/cve-2026-45133
• https://github.com/advisories/GHSA-c2p3-7m5p-cv8x

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")

CVE-2026-45304 / GHSA-4qpc-3hr4-r2p4

More information

Details

Description

Symfony\Component\Yaml\Parser resolves YAML aliases (*anchor) during parsing. Aliases that reference collections (arrays, stdClass, TaggedValue-wrapped collections) can themselves point to other collections containing aliases, creating exponential expansion at resolution time. A small input can blow up into a multi-gigabyte structure and exhaust memory: the classic "Billion Laughs" denial-of-service against any parser exposed to untrusted YAML.

Resolution

The Parser now counts collection alias resolutions in a shared ParserState object, with a default limit of 128, following the SnakeYAML model. Scalar aliases remain unrestricted since they cannot drive exponential growth. The limit is configurable via a new $maxAliasesForCollections argument on Parser::__construct(), Yaml::parse() and Yaml::parseFile(). A new Yaml::PARSE_EXCEPTION_ON_ALIAS flag also rejects all aliases outright when parsing fully untrusted input.

The patch for this issue is available here for branch 5.4.

Credits

Symfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it.

Severity

• CVSS Score: 2.7 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

• https://github.com/symfony/symfony/security/advisories/GHSA-4qpc-3hr4-r2p4
• https://github.com/symfony/symfony/commit/e77391b2e4f18821198f010d573674c8ed4a970a
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45304.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/yaml/CVE-2026-45304.yaml
• https://symfony.com/cve-2026-45304
• https://github.com/advisories/GHSA-4qpc-3hr4-r2p4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex

CVE-2026-45305 / GHSA-9frc-8383-795m

More information

Details

Description

Symfony\Component\Yaml\Parser::cleanup() strips the optional %YAML directive header, leading comments, and document start/end markers before parsing. The original regexes contained overlapping quantifiers, most notably '#^%YAML[: ][\d.]+.*\n#u', whose [\d.]+ and .* overlap on the dot, that exhibit catastrophic backtracking on crafted input. A single oversized %YAML directive header (or comment / document-marker line) makes the parser hang for an arbitrarily long time, denying service.

Resolution

The four regexes in Parser::cleanup() (YAML directive header, leading comments, document-start marker, document-end marker) have been rewritten with possessive quantifiers and unambiguous character classes so backtracking cannot occur.

The patch for this issue is available here for branch 5.4.

Credits

Symfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it.

Severity

• CVSS Score: 2.7 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

• https://github.com/symfony/symfony/security/advisories/GHSA-9frc-8383-795m
• https://github.com/symfony/symfony/commit/9749cd43c5e09b3735093623670b21b9d8a056cb
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45305.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/yaml/CVE-2026-45305.yaml
• https://symfony.com/cve-2026-45305
• https://github.com/advisories/GHSA-9frc-8383-795m

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

symfony/yaml (symfony/yaml)

v5.4.52

Compare Source

Changelog (symfony/yaml@v5.4.44...v5.4.52)

• security #cve-2026-45305 Harden the Parser::cleanup() regexes against catastrophic backtracking (@​nicolas-grekas)
• security #cve-2026-45304 Bound collection-alias resolution in the parser (@​nicolas-grekas)
• security #cve-2026-45133 Bound recursion depth in the parser (@​nicolas-grekas)

v5.4.45

Compare Source

Changelog (symfony/yaml@v5.4.44...v5.4.45)

• no significant changes

v5.4.44

Compare Source

Changelog (symfony/yaml@v5.4.43...v5.4.44)

• bug symfony/symfony#58279 [Yaml] parse empty sequence elements as null (@​xabbuh)

v5.4.43

Compare Source

Changelog (symfony/yaml@v5.4.42...v5.4.43)

• bug symfony/symfony#57968 [Yaml] 🐛 throw ParseException on invalid date (@​homersimpsons)

v5.4.40

Compare Source

Changelog (symfony/yaml@v5.4.39...v5.4.40)

• no significant changes

v5.4.39

Compare Source

Changelog (symfony/yaml@v5.4.38...v5.4.39)

• bug symfony/symfony#54706 [Yaml] call substr() with integer offsets (@​xabbuh)

v5.4.35

Compare Source

Changelog (symfony/yaml@v5.4.34...v5.4.35)

• no significant changes

v5.4.31

Compare Source

Changelog (symfony/yaml@v5.4.30...v5.4.31)

• bug symfony/symfony#52443 [Yaml] Fix uid binary parsing (@​mRoca)
• bug symfony/symfony#52408 [Yaml] Fix block scalar array parsing (@​NickSdot)

v5.4.30

Compare Source

Changelog (symfony/yaml@v5.4.29...v5.4.30)

• no significant changes

v5.4.23

Compare Source

Changelog (symfony/yaml@v5.4.22...v5.4.23)

• bug #​50066 Trim leading newlines when checking if value begins with a space (bradtreloar)

v5.4.21

Compare Source

Changelog (symfony/yaml@v5.4.20...v5.4.21)

• no significant changes

v5.4.19

Compare Source

Changelog (symfony/yaml@v5.4.18...v5.4.19)

• no significant changes

v5.4.17

Compare Source

Changelog (symfony/yaml@v5.4.16...v5.4.17)

• bug #​48331 fix dumping top-level tagged values (xabbuh)

v5.4.16

Compare Source

Changelog (symfony/yaml@v5.4.15...v5.4.16)

• bug #​48333 parse unquoted digits in tag values as integers (xabbuh)

v5.4.14

Compare Source

Changelog (symfony/yaml@v5.4.13...v5.4.14)

• no significant changes

v5.4.12

Compare Source

Changelog (symfony/yaml@v5.4.11...v5.4.12)

• no significant changes

v5.4.11

Compare Source

Changelog (symfony/yaml@v5.4.10...v5.4.11)

• no significant changes

v5.4.10

Compare Source

Changelog (symfony/yaml@v5.4.9...v5.4.10)

• no significant changes

v5.4.3

Compare Source

Changelog (symfony/yaml@v5.4.2...v5.4.3)

• bug #​45140 Making the parser stateless (mamazu)

v5.4.2

Compare Source

Changelog (symfony/yaml@v5.4.1...v5.4.2)

• no significant changes

v5.4.0

Compare Source

Changelog (symfony/yaml@v5.4.0-RC1...v5.4.0)

• no significant changes

v5.3.14

Compare Source

Changelog (symfony/yaml@v5.3.13...v5.3.14)

• bug #​45140 Making the parser stateless (mamazu)

v5.3.13

Compare Source

Changelog (symfony/yaml@v5.3.12...v5.3.13)

• no significant changes

v5.3.11

Compare Source

Changelog (symfony/yaml@v5.3.10...v5.3.11)

• bug #​44131 properly parse quoted strings tagged with !!str (xabbuh)
• bug #​44034 don't try to replace references in quoted strings (xabbuh)

v5.3.6

Compare Source

Changelog (symfony/yaml@v5.3.5...v5.3.6)

• bug #​42296 Remove PHP 8.0 polyfill (derrabus)

v5.3.4

Compare Source

Changelog (symfony/yaml@v5.3.3...v5.3.4)

• bug #​42074 Fix ctype_digit deprecation (alexpott)

v5.3.3

Compare Source

Changelog (symfony/yaml@v5.3.2...v5.3.3)

• bug #​40857 Add support of PHP enumerations (alexandre-daubois)

v5.3.2

Compare Source

Changelog (symfony/yaml@v5.3.1...v5.3.2)

• no significant changes

v5.3.0

Compare Source

Changelog (symfony/yaml@v5.3.0-RC1...v5.3.0)

• bug #​41394 fix support for years outside of the 32b range on x86 arch (nicolas-grekas)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: composer.lock

Command failed: composer install --ignore-platform-req=ext-* --ignore-platform-req=lib-* --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins
Installing dependencies from lock file (including require-dev)
Verifying lock file contents can be installed on current platform.
Your lock file does not contain a compatible set of packages. Please run composer update.

  Problem 1
    - laminas/laminas-code is locked to version 4.4.2 and an update of this package was not requested.
    - laminas/laminas-code 4.4.2 requires php ^7.4 || ~8.0.0 -> your php version (8.5.9) does not satisfy that requirement.
  Problem 2
    - php-amqplib/php-amqplib is locked to version v2.12.3 and an update of this package was not requested.
    - php-amqplib/php-amqplib v2.12.3 requires php >=5.6.3,<8.0 -> your php version (8.5.9) does not satisfy that requirement.
  Problem 3
    - clivern/chunk is locked to version 2.0.1 and an update of this package was not requested.
    - clivern/chunk 2.0.1 requires php-amqplib/php-amqplib ^2.11 -> satisfiable by php-amqplib/php-amqplib[v2.12.3].
    - php-amqplib/php-amqplib v2.12.3 requires php >=5.6.3,<8.0 -> your php version (8.5.9) does not satisfy that requirement.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request