CVE WATCH / VULNERABILITY DETAIL
CVE-2026-109449
UNKNOWNCVSS 0NVD feed
Published 15 October 2026 · tracked since 16 October 2026
Description
In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-111091 HIGH 7.8
- CVE-2026-100349
- CVE-2026-9703 HIGH 7.1
- CVE-2026-95179 HIGH 7.5
- CVE-2026-95180 MEDIUM 5.5
- CVE-2026-55154 MEDIUM 5.4
- CVE-2026-47168 CRITICAL 9.1
- CVE-2026-109413
- CVE-2026-108082
- CVE-2026-104586