This might be a false positive, but yaml-generation/composer.lock around line 298 looked worth a second pair of eyes.
The installed symfony/yaml 5.4.3 lacks a recursion depth limit in its YAML parser. An attacker can supply deeply nested mappings or sequences that cause unbounded recursion in Parser::parseBlock() and Inline::parse*(), exhausting the PHP call stack and resulting in a denial‑of‑service crash. This is a high‑severity vulnerability (CVE‑2026‑45133) because it can be triggered remotely via any user‑controlled YAML input, potentially bringing down the entire application. The fix is to upgrade symfony/yaml to a version where the depth limit was introduced (≥ 5.4.52, 6.4.40, 7.4.12, or 8.0.12).
Something like this might fix it:
*** Begin Patch
*** Update File: composer.json
@@
- "symfony/yaml": "5.4.3",
+ "symfony/yaml": "^5.4.52",
*** End Patch
/*** After updating composer.json, run the following commands to apply the fix ***/
composer update symfony/yaml --with-all-dependencies
composer install
/* The above will regenerate composer.lock with the secure version and ensure the application uses the patched parser that enforces a maximum nesting depth, preventing stack‑overflow DoS attacks. */
For reference: rule CVE-2026-45133. Rated high.
I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
This might be a false positive, but
yaml-generation/composer.lockaround line 298 looked worth a second pair of eyes.The installed symfony/yaml 5.4.3 lacks a recursion depth limit in its YAML parser. An attacker can supply deeply nested mappings or sequences that cause unbounded recursion in Parser::parseBlock() and Inline::parse*(), exhausting the PHP call stack and resulting in a denial‑of‑service crash. This is a high‑severity vulnerability (CVE‑2026‑45133) because it can be triggered remotely via any user‑controlled YAML input, potentially bringing down the entire application. The fix is to upgrade symfony/yaml to a version where the depth limit was introduced (≥ 5.4.52, 6.4.40, 7.4.12, or 8.0.12).
Something like this might fix it:
For reference: rule
CVE-2026-45133. Rated high.I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.