GHSA-4qpc-3hr4-r2p4 Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")

• Packagist symfony/yaml: < 5.4.52 → fixed in 5.4.52 • Packagist symfony/symfony: < 5.4.52 → fixed in 5.4.52 • Packagist symfony/symfony: >= 6.0.0, < 6.4.40 → fixed in 6.4.40 • Packagist symfony/symfony: >= 7.0.0, < 7.4.12 → fixed in 7.4.12 • Packagist symfony/symfony: >= 8.0.0, < 8.0.12 → fixed in 8.0.12 • Packagist symfony/yaml: >= 6.0.0, < 6.4.40 → fixed in 6.4.40 • Packagist symfony/yaml: >= 7.0.0, < 7.4.12 → fixed in 7.4.12 • Packagist symfony/yaml: >= 8.0.0, < 8.0.12 → fixed in 8.0.12

Description `Symfony\Component\Yaml\Parser` resolves YAML aliases (`*anchor`) during parsing. Aliases that reference *collections* (arrays, `stdClass`, `TaggedValue`-wrapped collections) can themselves point to other collections containing aliases, creating exponential expansion at resolution time. A small input can blow up into a multi-gigabyte structure and exhaust memory: the classic "Billion Laughs" denial-of-service against any parser exposed to untrusted YAML. Resolution The `Parser` now counts collection alias resolutions in a shared `ParserState` object, with a default limit of 128, following the SnakeYAML model. Scalar aliases remain unrestricted since they cannot drive exponential growth. The limit is configurable via a new `$maxAliasesForCollections` argument on `Parser::__construct()`, `Yaml::parse()` and `Yaml::parseFile()`. A new `Yaml::PARSE_EXCEPTION_ON_ALIAS` flag also rejects all aliases outright when parsing fully untrusted input. The patch for this issue is available here for branch 5.4. Credits Symfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it.