Skip to content
RequestGuard Vulnerabilities
Pricing
Vulnerability intelligence Composer

symfony/yaml

Loads and dumps YAML files

Composer latest 8.1.6 MIT

Evidence path

Version, exploitation, severity

RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.

1

Latest version

8.1.6

No matching published advisory returned

2

Known exploitation

No KEV match

Checked by exact CVE identifier

3

Highest advisory severity

High

5 active advisories

Check an exact version

The registry confirms the version, then OSV checks advisories for that exact value.

Published records

Advisories

5
GHSA-7w53-hfpw-rg3g high

Symfony Arbitrary PHP code Execution

Affected range

ECOSYSTEM: introduced 2.0.0; fixed 2.0.22ECOSYSTEM: introduced 2.1.0; fixed 2.1.7ECOSYSTEM: introduced 2.2.0-BETA1; fixed 2.2.0-BETA2>=2.0.0,<2.0.22|>=2.1.0,<2.1.7

Fixed versions: 2.0.22, 2.1.7, 2.2.0-BETA2

CVE-2013-1397 Source ↗Source ↗
GHSA-9frc-8383-795m low

Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex

Affected range

ECOSYSTEM: introduced 0; fixed 5.4.52ECOSYSTEM: introduced 6.0.0; fixed 6.4.40ECOSYSTEM: introduced 7.0.0; fixed 7.4.12ECOSYSTEM: introduced 8.0.0; fixed 8.0.12>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12

Fixed versions: 5.4.52, 6.4.40, 7.4.12, 8.0.12

CVE-2026-45305 Source ↗Source ↗
GHSA-c2p3-7m5p-cv8x low

Symfony hardened the parser when handling untrusted input

Affected range

ECOSYSTEM: introduced 0; fixed 5.4.52ECOSYSTEM: introduced 6.0.0; fixed 6.4.40ECOSYSTEM: introduced 7.0.0; fixed 7.4.12ECOSYSTEM: introduced 8.0.0; fixed 8.0.12>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12

Fixed versions: 5.4.52, 6.4.40, 7.4.12, 8.0.12

CVE-2026-45133 Source ↗Source ↗
GHSA-4qpc-3hr4-r2p4 low

Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")

Affected range

ECOSYSTEM: introduced 0; fixed 5.4.52ECOSYSTEM: introduced 6.0.0; fixed 6.4.40ECOSYSTEM: introduced 7.0.0; fixed 7.4.12ECOSYSTEM: introduced 8.0.0; fixed 8.0.12>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12

Fixed versions: 5.4.52, 6.4.40, 7.4.12, 8.0.12

CVE-2026-45304 Source ↗Source ↗