Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.3.0-BETA1 until 7.4.12 and 8.0.12, the JsonPath component compiles attacker-controlled match() and search() filter patterns directly into preg_match() without a length cap, i-regexp restriction, or bounded backtracking, allowing catastrophic-backtracking expressions to pin worker CPU and cause denial of service. This issue is fixed in versions 7.4.12 and 8.0.12.
References
| Link | Resource |
|---|---|
| https://github.com/symfony/symfony/commit/1ac2d47418ec23066112db1e6ca35be6fe123d14 | Patch |
| https://github.com/symfony/symfony/releases/tag/v7.4.12 | Product Release Notes |
| https://github.com/symfony/symfony/releases/tag/v8.0.12 | Product Release Notes |
| https://github.com/symfony/symfony/security/advisories/GHSA-8v8v-g73j-492j | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
15 Jul 2026, 15:36
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/symfony/symfony/commit/1ac2d47418ec23066112db1e6ca35be6fe123d14 - Patch | |
| References | () https://github.com/symfony/symfony/releases/tag/v7.4.12 - Product, Release Notes | |
| References | () https://github.com/symfony/symfony/releases/tag/v8.0.12 - Product, Release Notes | |
| References | () https://github.com/symfony/symfony/security/advisories/GHSA-8v8v-g73j-492j - Patch, Vendor Advisory | |
| First Time |
Sensiolabs symfony
Sensiolabs |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CPE | cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* |
14 Jul 2026, 18:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-07-14 18:17
Updated : 2026-07-21 19:17
NVD link : CVE-2026-45756
Mitre link : CVE-2026-45756
CVE.ORG link : CVE-2026-45756
JSON object : View
Products Affected
sensiolabs
- symfony