Shielder, together withOSTIFand theSovereign Tech Agency, performed a Security Audit of theSymfony YAMLcomponent, a PHP library to parse and dump YAML files. The audit resulted in five (5) findings ranging from low to informational severity, including three (3) CVEs. All of them have been addressed by the Symfony maintainers. Today, we are publishing thefull reportin ourdedicated repository. In December 2025, Shielder was hired to perform a Security Audit of theSymfony YAMLcomponent, a PHP library to load and dump YAML files. The audit was facilitated by theOpen Source Technology Improvement Fund (OSTIF). YAML -YAML Ain’t Markup Language- is a human-friendly data serialization language for all programming languages. It is a hugely popular format for configuration files, striking a balance between human readability and advanced features. The Symfony YAML component is shipped by default together withSymfony, an industry-leading PHP framework for building web applications, but it can also be pulled in as a standalone Composer package. It provides: The source code is available athttps://github.com/symfony/yaml. The audit mainly focused on: Given the limited size of the codebase, the audit was mostly performed following aManual Source Code Reviewapproach. We directed the review towards three classes of threats: We also set up a fuzzing campaign using the experimentalPHP-Fuzzer. The goal of this campaign was to surface crashes and similar errors, but no interesting behavior was observed. Finally, to measure how closely Symfony YAML follows the YAML spec, we wrote a script to run the component against theYAML Test Suite: feed each test’sin.yamlto the parser, serialize the result withjson_encode, and diff it against the expectedin.json. The Symfony YAML component is, overall, adequately robust and well designed from a security standpoint - but there is still some room for improvement. The Shielder team identifiedthree (3) lowandtwo (2) informationalfindings. The main themes were unmitigated resource starvation when parsing complex data, and a lack of security-focused documentation around the parser’s more dangerous features. The first three findings are all variations on the same theme: trying to exploit an “amplification factor” to turn a small input into a huge amount of work for the component. Infinite Recursion of Nested YAML Blocks (CVE-2026-45133).ThedoParse()andparseBlock()methods inParser.phpare mutually recursive: every timedoParse()meets an indented line, it callsparseBlock(), which spins up a new parser and callsdoParse()on the indented content. Since nothing capped the maximum depth, a deeply nested document keeps pushing frames until PHP gives up with a Fatal Error. Unbounded Alias Resolution - a.k.a. “Billion Laughs” (CVE-2026-45304).YAML supports anchors (&foo) and aliases (*foo) so you can reuse a node instead of repeating it. Without a cap on how many times those references can expand, this can be exploited for the classicBillion Laughsamplification: A tiny document expands into a structure with billions of nodes, exhausting memory. A fun wrinkle we noted in the report: thanks to PHP’s lazy allocation, the process often doesn’t die onparse(), but on the laterjson_encode(), when something finally walks the structure to materialize it. ReDoS inParser::cleanup(CVE-2026-45305).Before parsing,Parser::cleanup()strips spaces, headers, and comments. One of the regexes used to remove YAML headers is: The[\d\.]+and.*subpatterns can match the same input, and with greedy quantifiers that can lead to catastrophic backtracking: a crafted header makes the regex engine explore an exponential number of paths, stalling the process. All three were reported tosecurity@symfony.com, moved to GitHub advisories, assigned CVEs, and fixed by following the attached recommendations.