Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.3.0-BETA1 until 7.4.12 and 8.0.12, the JsonPath component compiles attacker-controlled match() and search() filter patterns directly into preg_match() without a length cap, i-regexp restriction, or bounded backtracking, allowing catastrophic-backtracking expressions to pin worker CPU and cause denial of service. This issue is fixed in versions 7.4.12 and 8.0.12.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
symfony symfony
>= 7.3.0-BETA1, < 7.4.12affected>= 8.0.0-BETA1, < 8.0.12affected
symfony json-path
>= 7.3.0-BETA1, < 7.4.12affected>= 8.0.0-BETA1, < 8.0.12affected