Read the docs
TI-2026-36410 Aliases CVE-2026-49209GHSA-mm82-c99c-h2cf

Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests

Priority LOW 25CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke() iterates over the client-supplied actions array and issues a full HttpKernel sub-request for each entry; because the array size is never bounded, an authenticated client can submit a single _batch request containing thousands of actions and exhaust CPU, memory, and database connections on the application server. This issue is fixed in versions 2.36.0 and 3.1.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0056 46th percentileScored 2026-11-07
Fix Fixed ux (symfony): 3.1.0, 2.36.0symfony/ux-live-component (Packagist): 2.36.0, 3.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
symfonyux3.0.0 to before 3.1.0; 2.5.0 to before 2.36.03.1.0, 2.36.0Patch availableCNA
—symfony/ux-live-component (Packagist)2.5.0 to before 2.36.02.36.0Patch availableGHSA-mm82-c99c-h2cf
—symfony/ux-live-component (Packagist)3.0.0 to before 3.1.03.1.0Patch availableGHSA-mm82-c99c-h2cf
  • ux Vendorsymfony Affected 3.0.0 to before 3.1.0; 2.5.0 to before 2.36.0 Fixed in 3.1.0, 2.36.0 Patch available CNA
  • symfony/ux-live-component (Packagist) Vendor— Affected 2.5.0 to before 2.36.0 Fixed in 2.36.0 Patch available GHSA-mm82-c99c-h2cf
  • symfony/ux-live-component (Packagist) Vendor— Affected 3.0.0 to before 3.1.0 Fixed in 3.1.0 Patch available GHSA-mm82-c99c-h2cf

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:symfony:ux:*:*:*:*:*:*:*:*2.5.0 to before 2.36.0Vulnerablesymfony
cpe:2.3:a:symfony:ux:3.0.0:*:*:*:*:*:*:*3.0.0Vulnerablesymfony
  • cpe:2.3:a:symfony:ux:*:*:*:*:*:*:*:* Versions 2.5.0 to before 2.36.0 Vulnerable ·symfony
  • cpe:2.3:a:symfony:ux:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·symfony

Remediation

  • Fix · CNA ux (symfony) Fixed in 3.1.0, 2.36.0
  • Fix · GHSA-mm82-c99c-h2cf symfony/ux-live-component (Packagist) Fixed in 2.36.0 Advisory →
  • Fix · GHSA-mm82-c99c-h2cf symfony/ux-live-component (Packagist) Fixed in 3.1.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49209
  2. 2026-10-03 Alias added: GHSA-mm82-c99c-h2cf

References

Patch 1

Advisory 1

Other 4

  • TI-2026-36412 Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil CVSS 4.0MEDIUM 6.9
  • TI-2026-36409 Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor CVSS 4.0MEDIUM 6.9
  • TI-2026-36413 Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding CVSS 4.0MEDIUM 6.9
  • TI-2026-40330 Symfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses CVSS 3.1MEDIUM 6.1
  • TI-2026-36417 Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data CVSS 4.0MEDIUM 5.1
  • TI-2026-36411 Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag CVSS 4.0LOW 2.3
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences