CVE-2026-109449

HighCVSS 8.7/10Last modified Oct 16, 2026

Description

In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed.

#[Assert\ExpressionSyntax] passes the validated value to ExpressionLanguage::lint(), so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions.

This issue affects symfony/expression-language through v5.4.53, v6.0.0-BETA1 through v6.4.47, v7.0.0-BETA1 through v7.4.20, and v8.0.0-BETA1 through v8.1.8.

Metrics

CVSS 4.0 8.7/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-674

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
sensiolabssymfony< v5.4.54; >= v6.0.0-BETA1, < v6.4.48; >= v7.0.0-BETA1, < v7.4.21; >= v8.0.0-BETA1, < v8.1.9

References

Timeline

Published
Oct 15, 2026
Last modified
Oct 16, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-109458.8Use after free in PDF in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gesturCVE-2026-1094537.0Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.CVE-2026-1094549.0Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attCVE-2026-1094556.5Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.CVE-2026-1094564.6Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attCVE-2026-1094578.0Improper neutralization of special elements used in an os command ('os command injection') in Azure CLI allows an authorized attacker to exeCVE-2026-1094598.1Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.CVE-2026-109467.5Heap buffer overflow in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UCVE-2026-1094605.5Exposure of sensitive information to an unauthorized actor in Microsoft Entra Private Network Connector allows an authorized attacker to disCVE-2026-1094615.9Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over CVE-2026-1094624.4Improper check for certificate revocation in Azure Firmware allows an authorized attacker to bypass a security feature locally.CVE-2026-1094638.8Deserialization of untrusted data in Windows DNS allows an unauthorized attacker to execute code over a network.
CVE-2026-109449: High severity, CVSS 8.7 | Vulnix