CVE-2026-49209 MEDIUM

CVE-2026-49209: Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests

Vendor Symfony
Product ux
Weakness CWE-770 · Uncontrolled resource consumption
Published July 17, 2026
Last update July 17, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke() iterates over the client-supplied actions array and issues a full HttpKernel sub-request for each entry; because the array size is never bounded, an authenticated client can submit a single _batch request containing thousands of actions and exhaust CPU, memory, and database connections on the application server. This issue is fixed in versions 2.36.0 and 3.1.0.

Key dates

02Disclosure timeline

July 17, 2026 CVE published
July 17, 2026 Record updated