https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T04:23:38.813380+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-338537 EUVD-2026-338537 2026-10-06T04:23:38.864479+00:00 EUVD-2026-338537 https://cve.radiocsirt.org/vuln/fkie_cve-2026-49209 fkie_cve-2026-49209 2026-10-06T04:23:38.864524+00:00

Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke() iterates over the client-supplied actions array and issues a full HttpKernel sub-request for each entry; because the array size is never bounded, an authenticated client can submit a single _batch request containing thousands of actions and exhaust CPU, memory, and database connections on the application server. This issue is fixed in versions 2.36.0 and 3.1.0.

 https://cve.radiocsirt.org/vuln/ghsa-mm82-c99c-h2cf GHSA-mm82-c99c-h2cf — symfony/ux-live-component: Denial of service via unbounded batch action requests 2026-10-06T04:23:38.864562+00:00

Affected: Packagist: symfony/ux-live-component

### Description

`Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke()` iterates over the client-supplied `actions` array and issues a full `HttpKernel` sub-request for each entry (event subscribers, validators, Doctrine, rendering). The array size is never bounded, so an authenticated client can submit a single `_batch` request containing thousands of actions and exhaust CPU, memory, and database connections on the application server.

### Resolution

`BatchActionController` now enforces an upper bound of 50 actions per `_batch` request (`MAX_ACTIONS_PER_BATCH`) and rejects larger payloads up front with a `BadRequestHttpException`. The matching JavaScript backend was also updated to split larger client-side batches into multiple requests so legitimate usage isn't affected.

The patch for this issue is available [here](https://github.com/symfony/ux/commit/95e878d5257f13d6d652ca95e3ef6bb0934d674f) for branch 2.x (and forward-ported to 3.x).

### Credits

Symfony would like to thank Pascal Cescon for reporting the issue and Hugo Alliaume for providing the fix.