Resource exhaustion in Symfony Json-path

CVE-2026-45756

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.3.0-BETA1 until 7.4.12 and 8.0.12, the JsonPath component compiles attacker-controlled match() and search() filter patterns directly i…

Vulnerability class: DoS (Denial of Service)

Affected products

  • Symfony Json-path — versions >= 7.3.0-BETA1, < 7.4.12, >= 8.0.0-BETA1, < 8.0.12
  • Symfony — versions >= 7.3.0-BETA1, < 7.4.12, >= 8.0.0-BETA1, < 8.0.12

Weakness classification (CWE)

References