CVE-2026-109449
Description
A flaw was found in symfony/expression-language. The parser does not enforce a limit on the depth of nested expressions when constructing syntax trees. A remote attacker can exploit this flaw by submitting a crafted expression with deeply nested structures, causing the application process to crash when freeing the parsed data and resulting in a Denial of Service (DoS).
Statement
Red Hat rates the impact of this vulnerability as Important because an unauthenticated remote attacker can crash the PHP execution process with minimal effort, resulting in a denial of service. The flaw is triggered when an application accepts untrusted input and passes it to the ExpressionLanguage parser or syntax validation routines without bounding recursive depth. If user-controlled expressions are not processed or exposed to public networks, the risk is significantly minimized.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
