CVE-2026-109449 - Symfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process
CVE ID :CVE-2026-109449 Published : Oct. 15, 2026, 4:17 p.m. | 1 hour, 15 minutes ago Description :In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression...