https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 10:52:52 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-338537 EUVD-2026-338537 https://cve.radiocsirt.org/vuln/euvd-2026-338537 https://cve.radiocsirt.org/vuln/fkie_cve-2026-49209 <p>Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke() iterates over the client-supplied actions array and issues a full HttpKernel sub-request for each entry; because the array size is never bounded, an authenticated client can submit a single _batch request containing thousands of actions and exhaust CPU, memory, and database connections on the application server. This issue is fixed in versions 2.36.0 and 3.1.0.</p> <p>Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke() iterates over the client-supplied actions array and issues a full HttpKernel sub-request for each entry; because the array size is never bounded, an authenticated client can submit a single _batch request containing thousands of actions and exhaust CPU, memory, and database connections on the application server. This issue is fixed in versions 2.36.0 and 3.1.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-49209 https://cve.radiocsirt.org/vuln/ghsa-mm82-c99c-h2cf <p><strong>Affected:</strong> Packagist: symfony/ux-live-component</p> <p>### Description</p> <p>`Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke()` iterates over the client-supplied `actions` array and issues a full `HttpKernel` sub-request for each entry (event subscribers, validators, Doctrine, rendering). The array size is never bounded, so an authenticated client can submit a single `_batch` request containing thousands of actions and exhaust CPU, memory, and database connections on the application server.</p> <p>### Resolution</p> <p>`BatchActionController` now enforces an upper bound of 50 actions per `_batch` request (`MAX_ACTIONS_PER_BATCH`) and rejects larger payloads up front with a `BadRequestHttpException`. The matching JavaScript backend was also updated to split larger client-side batches into multiple requests so legitimate usage isn&#39;t affected.</p> <p>The patch for this issue is available [here](https://github.com/symfony/ux/commit/95e878d5257f13d6d652ca95e3ef6bb0934d674f) for branch 2.x (and forward-ported to 3.x).</p> <p>### Credits</p> <p>Symfony would like to thank Pascal Cescon for reporting the issue and Hugo Alliaume for providing the fix.</p> <p><strong>Affected:</strong> Packagist: symfony/ux-live-component</p> <p>### Description</p> <p>`Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke()` iterates over the client-supplied `actions` array and issues a full `HttpKernel` sub-request for each entry (event subscribers, validators, Doctrine, rendering). The array size is never bounded, so an authenticated client can submit a single `_batch` request containing thousands of actions and exhaust CPU, memory, and database connections on the application server.</p> <p>### Resolution</p> <p>`BatchActionController` now enforces an upper bound of 50 actions per `_batch` request (`MAX_ACTIONS_PER_BATCH`) and rejects larger payloads up front with a `BadRequestHttpException`. The matching JavaScript backend was also updated to split larger client-side batches into multiple requests so legitimate usage isn&#39;t affected.</p> <p>The patch for this issue is available [here](https://github.com/symfony/ux/commit/95e878d5257f13d6d652ca95e3ef6bb0934d674f) for branch 2.x (and forward-ported to 3.x).</p> <p>### Credits</p> <p>Symfony would like to thank Pascal Cescon for reporting the issue and Hugo Alliaume for providing the fix.</p> https://cve.radiocsirt.org/vuln/ghsa-mm82-c99c-h2cf