CVE-2026-49209Low▾ Sunlitsymfony/ux-live-component: Denial of service via unbounded batch action requests
▾ Sunlit zone — Low / medium · no exploitation signal
impact 13.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.3%
0.3% → 0.6%
Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke() iterates over the client-supplied actions array and issues a full HttpKernel sub-request for each entry (event subscribers, validators, Doctrine, rendering). The array size is never bounded, so an authenticated client can submit a single _batch request containing thousands of actions and exhaust CPU, memory, and database connections on the application server.
BatchActionController now enforces an upper bound of 50 actions per _batch request (MAX_ACTIONS_PER_BATCH) and rejects larger payloads up front with a BadRequestHttpException. The matching JavaScript backend was also updated to split larger client-side batches into multiple requests so legitimate usage isn't affected.
The patch for this issue is available here for branch 2.x (and forward-ported to 3.x).
Symfony would like to thank Pascal Cescon for reporting the issue and Hugo Alliaume for providing the fix.
symfony/ux-live-component >= 2.5.0, < 2.36.0symfony/ux-live-component >= 3.0.0, < 3.1.0Upgrade to a patched release:
symfony/ux-live-component 2.36.0symfony/ux-live-component 3.1.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-49208Mediumux-live-component: Format-less date LiveProps parsed with the permissive DateTime constructor
CVE-2026-49210Mediumsymfony/ux-live-component: XSS via attacker-controlled child component tag
CVE-2026-49212Lowsymfony/ux-live-component: LiveComponentHydrator HMAC checksum lacks component and slot binding
CVE-2026-49215Lowsymfony/ux-live-component: CSRF Protection Bypass — Accept Header is CORS-Safelisted
CVE-2026-108082High· 8.7Symfony is a PHP framework for web and console applications and a set of reusable PHP components
CVE-2026-109413High· 8.7In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting le…