CVE-2026-49209

Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke() iterates over the client-supplied actions array and issues a full HttpKernel sub-request for each entry; because the array size is never bounded, an authenticated client can submit a single _batch request containing thousands of actions and exhaust CPU, memory, and database connections on the application server. This issue is fixed in versions 2.36.0 and 3.1.0.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/symfony/ux/commit/95e878d5257f13d6d652ca95e3ef6bb0934d674f	Patch
https://github.com/symfony/ux/releases/tag/v2.36.0	Release Notes
https://github.com/symfony/ux/releases/tag/v3.1.0	Release Notes
https://github.com/symfony/ux/security/advisories/GHSA-mm82-c99c-h2cf	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:symfony:ux::::::::
	cpe:2.3:a:symfony:ux:3.0.0:::::::*

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Symfony UX es un ecosistema JavaScript para Symfony. Desde 2.5.0 hasta 2.36.0 y 3.1.0, Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke() itera sobre el array de acciones proporcionado por el cliente y emite una subpetición HttpKernel completa para cada entrada; debido a que el tamaño del array nunca está limitado, un cliente autenticado puede enviar una única petición _batch que contiene miles de acciones y agotar la CPU, la memoria y las conexiones de la base de datos en el servidor de aplicaciones. Este problema está solucionado en las versiones 2.36.0 y 3.1.0.

Information

Published : 2026-07-17 17:17

Updated : 2026-10-24 20:10

NVD link : CVE-2026-49209

Mitre link : CVE-2026-49209

CVE.ORG link : CVE-2026-49209

JSON object : View

Products Affected

symfony

ux

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-49209", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49209", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-17T17:26:12.348589Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "symfony", "product": "ux", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.1.0"}, {"status": "affected", "version": ">= 2.5.0, < 2.36.0"}]}]}], "published": "2026-07-17T17:17:15.517", "references": [{"url": "https://github.com/symfony/ux/commit/95e878d5257f13d6d652ca95e3ef6bb0934d674f", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/symfony/ux/releases/tag/v2.36.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/symfony/ux/releases/tag/v3.1.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/symfony/ux/security/advisories/GHSA-mm82-c99c-h2cf", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\\UX\\LiveComponent\\Controller\\BatchActionController::__invoke() iterates over the client-supplied actions array and issues a full HttpKernel sub-request for each entry; because the array size is never bounded, an authenticated client can submit a single _batch request containing thousands of actions and exhaust CPU, memory, and database connections on the application server. This issue is fixed in versions 2.36.0 and 3.1.0."}, {"lang": "es", "value": "Symfony UX es un ecosistema JavaScript para Symfony. Desde 2.5.0 hasta 2.36.0 y 3.1.0, Symfony\\UX\\LiveComponent\\Controller\\BatchActionController::__invoke() itera sobre el array de acciones proporcionado por el cliente y emite una subpetici\u00f3n HttpKernel completa para cada entrada; debido a que el tama\u00f1o del array nunca est\u00e1 limitado, un cliente autenticado puede enviar una \u00fanica petici\u00f3n _batch que contiene miles de acciones y agotar la CPU, la memoria y las conexiones de la base de datos en el servidor de aplicaciones. Este problema est\u00e1 solucionado en las versiones 2.36.0 y 3.1.0."}], "lastModified": "2026-10-24T20:10:00.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:symfony:ux:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B6775A58-B302-4626-B8B7-0803471C6905", "versionEndExcluding": "2.36.0", "versionStartIncluding": "2.5.0"}, {"criteria": "cpe:2.3:a:symfony:ux:3.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3C0974BE-BF17-497A-BA94-8B89B2BE9788"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}