CVE WATCH / VULNERABILITY DETAIL
CVE-2026-109413
UNKNOWNCVSS 0NVD feed
Published 15 October 2026 · tracked since 16 October 2026
Description
In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-111091 HIGH 7.8
- CVE-2026-109449
- CVE-2026-100349
- CVE-2026-9703 HIGH 7.1
- CVE-2026-95179 HIGH 7.5
- CVE-2026-95180 MEDIUM 5.5
- CVE-2026-55154 MEDIUM 5.4
- CVE-2026-47168 CRITICAL 9.1
- CVE-2026-108082
- CVE-2026-104586