PHP package security
Is symfony/yaml vulnerable?
6 known security advisories for symfony/yaml. The latest was reported on 2026-08-30 and is fixed in 3.0.0, 4.0.0, 5.0.0, 5.1.0, 5.2.0, 5.3.0, 5.4.0, 5.4.54, 6.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.45, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.18, 8.1.0 and 8.1.6. The newest release, 8.1.10, is not affected by any of them.
3 high 3 low
- Known advisories
- 6
- Newest release
- 8.1.10
- Released
- 2026-10-18
- Affecting newest release
- 0
- Last synced
- 2026-11-03
Check your version
Security advisories for symfony/yaml
| Reported | Advisory | Severity | Affected | Fixed in |
|---|---|---|---|---|
| 2026-08-30 | CVE-2026-109413: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process CVE-2026-109413 · GitHub, FriendsOfPHP/security-advisories | high | >=2.0.0,<3.0.0 | >=3.0.0,<4.0.0 | >=4.0.0,<5.0.0 | >=5.0.0,<5.1.0 | >=5.1.0,<5.2.0 | >=5.2.0,<5.3.0 | >=5.3.0,<5.4.0 | >=5.4.0,<5.4.54 | >=6.0.0,<6.1.0 | >=6.1.0,<6.2.0 | >=6.2.0,<6.3.0 | >=6.3.0,<6.4.0 | >=6.4.0,<6.4.45 | >=7.0.0,<7.1.0 | >=7.1.0,<7.2.0 | >=7.2.0,<7.3.0 | >=7.3.0,<7.4.0 | >=7.4.0,<7.4.18 | >=8.0.0,<8.1.0 | >=8.1.0,<8.1.6 | 3.0.0, 4.0.0, 5.0.0, 5.1.0, 5.2.0, 5.3.0, 5.4.0, 5.4.54, 6.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.45, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.18, 8.1.0, 8.1.6 |
| 2026-05-20 | CVE-2026-45304: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs") CVE-2026-45304 · GitHub, FriendsOfPHP/security-advisories | low | >=2.0.0,<3.0.0 | >=3.0.0,<4.0.0 | >=4.0.0,<5.0.0 | >=5.0.0,<5.1.0 | >=5.1.0,<5.2.0 | >=5.2.0,<5.3.0 | >=5.3.0,<5.4.0 | >=5.4.0,<5.4.52 | >=6.0.0,<6.1.0 | >=6.1.0,<6.2.0 | >=6.2.0,<6.3.0 | >=6.3.0,<6.4.0 | >=6.4.0,<6.4.40 | >=7.0.0,<7.1.0 | >=7.1.0,<7.2.0 | >=7.2.0,<7.3.0 | >=7.3.0,<7.4.0 | >=7.4.0,<7.4.12 | >=8.0.0,<8.0.12 | 3.0.0, 4.0.0, 5.0.0, 5.1.0, 5.2.0, 5.3.0, 5.4.0, 5.4.52, 6.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.40, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.12, 8.0.12 |
| 2026-05-20 | CVE-2026-45305: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex CVE-2026-45305 · GitHub, FriendsOfPHP/security-advisories | low | >=2.0.0,<3.0.0 | >=3.0.0,<4.0.0 | >=4.0.0,<5.0.0 | >=5.0.0,<5.1.0 | >=5.1.0,<5.2.0 | >=5.2.0,<5.3.0 | >=5.3.0,<5.4.0 | >=5.4.0,<5.4.52 | >=6.0.0,<6.1.0 | >=6.1.0,<6.2.0 | >=6.2.0,<6.3.0 | >=6.3.0,<6.4.0 | >=6.4.0,<6.4.40 | >=7.0.0,<7.1.0 | >=7.1.0,<7.2.0 | >=7.2.0,<7.3.0 | >=7.3.0,<7.4.0 | >=7.4.0,<7.4.12 | >=8.0.0,<8.0.12 | 3.0.0, 4.0.0, 5.0.0, 5.1.0, 5.2.0, 5.3.0, 5.4.0, 5.4.52, 6.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.40, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.12, 8.0.12 |
| 2026-05-20 | CVE-2026-45133: YAML Parser Stack Exhaustion via Unbounded Recursion in Nested Blocks, Sequences, and Mappings CVE-2026-45133 · GitHub, FriendsOfPHP/security-advisories | low | >=2.0.0,<3.0.0 | >=3.0.0,<4.0.0 | >=4.0.0,<5.0.0 | >=5.0.0,<5.1.0 | >=5.1.0,<5.2.0 | >=5.2.0,<5.3.0 | >=5.3.0,<5.4.0 | >=5.4.0,<5.4.52 | >=6.0.0,<6.1.0 | >=6.1.0,<6.2.0 | >=6.2.0,<6.3.0 | >=6.3.0,<6.4.0 | >=6.4.0,<6.4.40 | >=7.0.0,<7.1.0 | >=7.1.0,<7.2.0 | >=7.2.0,<7.3.0 | >=7.3.0,<7.4.0 | >=7.4.0,<7.4.12 | >=8.0.0,<8.0.12 | 3.0.0, 4.0.0, 5.0.0, 5.1.0, 5.2.0, 5.3.0, 5.4.0, 5.4.52, 6.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.40, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.12, 8.0.12 |
| 2013-01-15 | Ability to enable/disable object support in YAML parsing and dumping CVE-2013-1397 · GitHub, FriendsOfPHP/security-advisories | high | >=2.0.0,<2.0.22 | >=2.1.0,<2.1.7 | 2.0.22, 2.1.7 |
| 2013-01-15 | Ability to enable/disable PHP parsing in Yaml::parse() CVE-2013-1348 · GitHub, FriendsOfPHP/security-advisories | high | >=2.0.0,<2.0.22 | 2.0.22 |
Need help patching or upgrading? Laskyr does PHP and Laravel security fixes and upgrades. Tell us what you run and we reply with a plan and a price.
Ask about a fixCheck your whole project. Paste your composer.lock and see every installed package with a known advisory. Nothing is stored.
Check composer.lockQuestions about symfony/yaml
Does symfony/yaml have known vulnerabilities?
Yes. Packagist lists 6 security advisories for symfony/yaml (3 high, 3 low severity). The most recent, reported 2026-08-30, is "CVE-2026-109413: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process". The newest release, 8.1.10, is outside every affected range.
Which version of symfony/yaml should I run?
The newest stable release is 8.1.10 (published 2026-10-18). The most recent advisory is fixed in 3.0.0, 4.0.0, 5.0.0, 5.1.0, 5.2.0, 5.3.0, 5.4.0, 5.4.54, 6.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.45, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.18, 8.1.0 and 8.1.6, so stay on or above the fixed version for your major version. Run composer update symfony/yaml, then composer audit to confirm nothing else is flagged.
How do I check if my symfony/yaml version is affected?
Run composer show symfony/yaml in your project to see the installed version, then enter it in the version check on this page. You can also run composer audit, which reads the same Packagist advisory data for every package in your composer.lock.