CVE-2026-45756

Katalog CVE

CVSS 7.5 · High EPSS 0,63%

Kerentanan Uncontrolled Resource Consumption pada sensiolabs symfony. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.3.0-BETA1 until 7.4.12 and 8.0.12, the JsonPath component compiles attacker-controlled match() and search() filter patterns directly into preg_match() without a length cap, i-regexp restriction, or bounded backtracking, allowing catastrophic-backtracking expressions to pin worker CPU and cause denial of service. This issue is fixed in versions 7.4.12 and 8.0.12.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

21 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-1333: Inefficient Regular Expression Complexity

EPSS (30 hari)

0,63% peluang dieksploitasi; lebih tinggi dari 48,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/symfony/symfony/security/advisories/GHSA-8v8v-g73j-492j patch · advisory vendor
• https://github.com/symfony/symfony/commit/1ac2d47418ec23066112db1e6ca35be6fe123d14 patch
• https://github.com/symfony/symfony/releases/tag/v7.4.12 product · release notes
• https://github.com/symfony/symfony/releases/tag/v8.0.12 product · release notes