GHSA-2v3c-qxhr-7vpv Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process

• Packagist symfony/symfony: >= 2.0.0, < 5.4.54 → fixed in 5.4.54 • Packagist symfony/symfony: >= 6.0.0, < 6.4.45 → fixed in 6.4.45 • Packagist symfony/symfony: >= 7.0.0, < 7.4.18 → fixed in 7.4.18 • Packagist symfony/symfony: >= 8.0.0, < 8.1.6 → fixed in 8.1.6 • Packagist symfony/yaml: >= 2.0.0, < 5.4.54 → fixed in 5.4.54 • Packagist symfony/yaml: >= 6.0.0, < 6.4.45 → fixed in 6.4.45 • Packagist symfony/yaml: >= 7.0.0, < 7.4.18 → fixed in 7.4.18 • Packagist symfony/yaml: >= 8.0.0, < 8.1.6 → fixed in 8.1.6

Description `Yaml\Parser::lexInlineStructure()` recursed through `lexInlineMapping()` and `lexInlineSequence()` for every `{` and `[` of an inline collection, without entering the nesting level that the rest of the parser bounds with `maxNestingLevel`. A document made of deeply nested inline collections, such as `[[[[...]]]]`, exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error. Any code parsing untrusted YAML is affected. That includes `#[MapRequestPayload]` when the Yaml component is installed and the endpoint does not restrict `acceptFormat`: a single unauthenticated request with a YAML content type is enough. Resolution The inline lexer now enters and leaves the same nesting level as the rest of the parser, so nested inline collections are bounded by `maxNestingLevel`, and the parser raises a `ParseException` beyond it. The patches for this issue are available here for branch 5.4 (and forward-ported to 6.4, 7.4, 8.1 and 8.2). Credits We would like to thank Nicolas Grekas for reporting the issue and providing the fix. References • Fix: #65688