CVE-2026-45304

Katalog CVE

CVSS 7.5 · High EPSS 0,68%

Kerentanan Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') pada sensiolabs symfony. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser resolved YAML collection aliases recursively, allowing a small untrusted YAML input to expand into a multi-gigabyte structure and exhaust memory. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

15 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

EPSS (30 hari)

0,68% peluang dieksploitasi; lebih tinggi dari 51,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/symfony/symfony/security/advisories/GHSA-4qpc-3hr4-r2p4 patch · advisory vendor
• https://github.com/symfony/symfony/commit/e77391b2e4f18821198f010d573674c8ed4a970a patch
• https://github.com/symfony/symfony/releases/tag/v5.4.52 product · release notes
• https://github.com/symfony/symfony/releases/tag/v6.4.40 product · release notes
• https://github.com/symfony/symfony/releases/tag/v7.4.12 product · release notes
• https://github.com/symfony/symfony/releases/tag/v8.0.12 product · release notes