遅咲きエンジニア@honda_dev
@for @CSRF 【映画レビューアプリ Laravel移植 開発記録】 composer auditで検出された脆弱性に追加対応！ 今回はsymfony/yamlの脆弱性（CVE-2026-109413）を修正。 7.4.12 → 7.4.18へ更新しました。 変更はcomposer.lockのみ。 無関係な依存パッケージは更新せず、PR 203をdevelopへマージ完了！
1001067
1.2K followersView on X
CVE-2026-109413
LOWCVSS 8.7 · HIGHSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A document made of deeply nested inline collections, such as [[[[...]]]], exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error. Any code parsing untrusted YAML is affected. That includes #[MapRequestPayload] when the Yaml component is installed and the endpoint does not restrict acceptFormat: a single unauthenticated request with a YAML content type is enough. This issue affects symfony/yaml through v5.4.53, v6.0.0-BETA1 through v6.4.44, v7.0.0-BETA1 through v7.4.17, and v8.0.0-BETA1 through v8.1.5.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-674
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day