CVE-2026-49209

Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke() iterates over the client-supplied actions array and issues a full HttpKernel sub-request for each entry; because the array size is never bounded, an authenticated client can submit a single _batch request containing thousands of actions and exhaust CPU, memory, and database connections on the application server. This issue is fixed in versions 2.36.0 and 3.1.0.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/symfony/ux/commit/95e878d5257f13d6d652ca95e3ef6bb0934d674f	Patch
https://github.com/symfony/ux/releases/tag/v2.36.0	Release Notes
https://github.com/symfony/ux/releases/tag/v3.1.0	Release Notes
https://github.com/symfony/ux/security/advisories/GHSA-mm82-c99c-h2cf	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:symfony:ux::::::::
	cpe:2.3:a:symfony:ux:3.0.0:::::::*

History

No history.

Information

Published : 2026-07-17 17:17

Updated : 2026-07-20 16:56

NVD link : CVE-2026-49209

Mitre link : CVE-2026-49209

CVE.ORG link : CVE-2026-49209

JSON object : View

Products Affected

symfony

ux

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-49209", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49209", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-17T17:26:12.348589Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "symfony", "product": "ux", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.1.0"}, {"status": "affected", "version": ">= 2.5.0, < 2.36.0"}]}]}], "published": "2026-07-17T17:17:15.517", "references": [{"url": "https://github.com/symfony/ux/commit/95e878d5257f13d6d652ca95e3ef6bb0934d674f", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/symfony/ux/releases/tag/v2.36.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/symfony/ux/releases/tag/v3.1.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/symfony/ux/security/advisories/GHSA-mm82-c99c-h2cf", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\\UX\\LiveComponent\\Controller\\BatchActionController::__invoke() iterates over the client-supplied actions array and issues a full HttpKernel sub-request for each entry; because the array size is never bounded, an authenticated client can submit a single _batch request containing thousands of actions and exhaust CPU, memory, and database connections on the application server. This issue is fixed in versions 2.36.0 and 3.1.0."}], "lastModified": "2026-07-20T16:56:45.080", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:symfony:ux:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B6775A58-B302-4626-B8B7-0803471C6905", "versionEndExcluding": "2.36.0", "versionStartIncluding": "2.5.0"}, {"criteria": "cpe:2.3:a:symfony:ux:3.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3C0974BE-BF17-497A-BA94-8B89B2BE9788"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}