Symfony YAML Component Parser Catastrophic Backtracking Vulnerability in Cleanup Method

A denial-of-service vulnerability has been identified in the Symfony YAML component's parser. The issue arises in the `Parser::cleanup()` method, which uses regular expressions with overlapping quantifiers to clean up YAML directives, comments, and document markers. This flaw allows specially crafted input to cause the parsing process to hang indefinitely. The vulnerability affects Symfony versions prior to 5.4.52, as well as 6.4.0 through 6.4.39, 7.0.0 through 7.4.11, and 8.0.0 through 8.0.11.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing the application to hang and become unresponsive for an extended period.

Reproduction

The vulnerability can be reproduced by using a YAML header that is excessively large, such as one that includes 100,000 '1' characters, or by adding a significant number of comments. This crafted input will cause the parser to hang indefinitely, demonstrating the catastrophic backtracking issue.

Remediation

Users can upgrade to Symfony versions 5.4.52, 6.4.40, 7.4.12, or 8.0.12 to address this vulnerability.