porro
Start free trial
Product
Needs attention Checks Setup Updates Alerts Tour the product →
Connectors
Laravel Filament Statamic Craft CMS JavaScript One-click install WordPress · soon All connectors →
Security Pricing

Free tools and reference

Lock-file checker Advisories End of life Blog Log in

Advisories  /  composer  /  symfony

composer

symfony/yaml

Security advisories for symfony/yaml, newest first. 6 known, all fixed. If you’re on 8.1.6 or later, none of them affect you.

RSS feed Check your lock file →

Latest version

8.1.10

Advisories

6 · 0 unfixed

Last advisory

30 Aug 2026

Safe from

8.1.6

6 advisories · newest first

HIGH 30 Aug 2026

CVE-2026-109413: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process

PKSA-xz3r-9gp4-4m1z · CVE-2026-109413

Affected

≥ 2.0.0, < 5.4.54 ≥ 6.0.0, < 6.4.45 ≥ 7.0.0, < 7.4.18
and 1 more ≥ 8.0.0, < 8.1.6

Fixed in

5.4.54 6.4.45 7.4.18
and 1 more 8.1.6
LOW 20 May 2026

CVE-2026-45304: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")

PKSA-v5yj-8nmz-sk2q · CVE-2026-45304

Affected

≥ 2.0.0, < 5.4.52 ≥ 6.0.0, < 6.4.40 ≥ 7.0.0, < 7.4.12
and 1 more ≥ 8.0.0, < 8.0.12

Fixed in

5.4.52 6.4.40 7.4.12
and 1 more 8.0.12
LOW 20 May 2026

CVE-2026-45305: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex

PKSA-ft77-7h5f-p3r6 · CVE-2026-45305

Affected

≥ 2.0.0, < 5.4.52 ≥ 6.0.0, < 6.4.40 ≥ 7.0.0, < 7.4.12
and 1 more ≥ 8.0.0, < 8.0.12

Fixed in

5.4.52 6.4.40 7.4.12
and 1 more 8.0.12
LOW 20 May 2026

CVE-2026-45133: YAML Parser Stack Exhaustion via Unbounded Recursion in Nested Blocks, Sequences, and Mappings

PKSA-b14r-zh1d-vdrc · CVE-2026-45133

Affected

≥ 2.0.0, < 5.4.52 ≥ 6.0.0, < 6.4.40 ≥ 7.0.0, < 7.4.12
and 1 more ≥ 8.0.0, < 8.0.12

Fixed in

5.4.52 6.4.40 7.4.12
and 1 more 8.0.12
HIGH 15 Jan 2013

Ability to enable/disable object support in YAML parsing and dumping

PKSA-xxgb-wq2d-7gpg · CVE-2013-1397

Affected

≥ 2.0.0, < 2.0.22 ≥ 2.1.0, < 2.1.7

Fixed in

2.0.22 2.1.7
HIGH 15 Jan 2013

Ability to enable/disable PHP parsing in Yaml::parse()

PKSA-4y51-dgkc-x4zc · CVE-2013-1348

Affected

≥ 2.0.0, < 2.0.22

Fixed in

2.0.22
/advisories/composer/symfony/yaml/feed.rss

From Packagist and the GitHub advisory database · synced hourly

Same vendor

symfony/cache3 advisories symfony/dom-crawler1 advisory symfony/error-handler1 advisory symfony/expression-language1 advisory symfony/http-client2 advisories symfony/http-foundation15 advisories symfony/http-kernel8 advisories symfony/mailer1 advisory

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →