symfony/expression-language vulnerabilities

Latest symfony/expression-language CVEs

Newest publication first

1. CVE-2026-109449 Symfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process

   Published 2026-10-15

   High·CVSS 8.7 EPSS 0.38%

   In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators o...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.