https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T21:10:15.140320+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0617 certfr-2026-avi-0617 — De multiples vulnérabilités ont été découvertes dans Symfony. Certaines d'entre elles permettent à un attaquant de prov… 2026-10-03T21:10:15.209568+00:00 certfr-2026-avi-0617 https://cve.radiocsirt.org/vuln/euvd-2026-337954 EUVD-2026-337954 2026-10-03T21:10:15.209610+00:00 EUVD-2026-337954 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45305 fkie_cve-2026-45305 2026-10-03T21:10:15.209626+00:00

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser::cleanup() used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup, allowing crafted input to make parsing hang for an arbitrarily long time. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

 https://cve.radiocsirt.org/vuln/ghsa-9frc-8383-795m GHSA-9frc-8383-795m — Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex 2026-10-03T21:10:15.209658+00:00

Affected: Packagist: symfony/yaml, Packagist: symfony/symfony

### Description

`Symfony\Component\Yaml\Parser::cleanup()` strips the optional `%YAML` directive header, leading comments, and document start/end markers before parsing. The original regexes contained overlapping quantifiers, most notably `'#^%YAML[: ][\d.]+.*\n#u'`, whose `[\d.]+` and `.*` overlap on the dot, that exhibit catastrophic backtracking on crafted input. A single oversized `%YAML` directive header (or comment / document-marker line) makes the parser hang for an arbitrarily long time, denying service.

### Resolution

The four regexes in `Parser::cleanup()` (YAML directive header, leading comments, document-start marker, document-end marker) have been rewritten with possessive quantifiers and unambiguous character classes so backtracking cannot occur.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/9749cd43c5e09b3735093623670b21b9d8a056cb) for branch 5.4.

### Credits

Symfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-45305 UBUNTU-CVE-2026-45305 2026-10-03T21:10:15.209698+00:00

Affected: Ubuntu:16.04:LTS: symfony, Ubuntu:Pro:18.04:LTS: symfony, Ubuntu:Pro:20.04:LTS: symfony, Ubuntu:Pro:22.04:LTS: symfony, Ubuntu:Pro:24.04:LTS: symfony, Ubuntu:25.10: symfony, Ubuntu:26.04:LTS: symfony

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser::cleanup() used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup, allowing crafted input to make parsing hang for an arbitrarily long time. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1805 WID-SEC-W-2026-1805 — Zabbix: Mehrere Schwachstellen 2026-10-03T21:10:15.209730+00:00

Ein Angreifer kann mehrere Schwachstellen in Zabbix ausnutzen, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.