# CVE-2026-123792

Symfony YAML parser flaw enables crafted YAML to exhaust PHP workers and cause DoS.

- Page: https://www.vulneraibility.com/cve/CVE-2026-123792
- CVSS: 8.7
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.50% (percentile 43.4)
- Weakness: CWE-407, CWE-1333
- Also known as: GHSA-hwfg-qwvh-2wfx
- Published: 2026-11-06

## Affected versions

- sensiolabs symfony: affected < 5.4.56; >= 6.0.0 and < 6.4.50; >= 7.0.0 and < 7.4.23; >= 8.0.0 and < 8.1.11

A version outside these ranges is not a statement that it is unaffected.

## Impact

Unauthenticated remote request with YAML content causes exponential parsing and memory use, exhausting PHP workers and causing service denial.

## Action

Immediate action required

## Recommendation

Upgrade Symfony to fixed versions ASAP; block or validate YAML content-types and restrict acceptFormat.

## References

- [advisory] https://github.com/symfony/symfony/security/advisories/GHSA-hwfg-qwvh-2wfx
- [patch] https://github.com/symfony/symfony/commit/487f63bf2cacebc8ed8273c5c10d92955acd2402
- [patch] https://github.com/symfony/symfony/commit/08db22d52e5d3e6ec2f5c50db30a4d818100ffb9
- [patch] https://github.com/symfony/symfony/commit/49e03035eda3000e978a4612db74900013255ccd

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.