CVE-2026-49209

UNKNOWN 0.0

Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke() iterates over the client-supplied actions array and issues a full HttpKernel sub-request for each entry; because the array size is never bounded, an authenticated client can submit a single _batch request containing thousands of actions and exhaust CPU, memory, and database connections on the application server. This issue is fixed in versions 2.36.0 and 3.1.0.

CWE	CWE-770
Vendor	symfony
Product	ux
Published	Jul 17, 2026

Stay Ahead of the Next One

Get instant alerts for symfony ux

Be the first to know when new unknown vulnerabilities affecting symfony ux are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

symfony / ux

>= 3.0.0, < 3.1.0 >= 2.5.0, < 2.36.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/symfony/ux/security/advisories/GHSA-mm82-c99c-h2cf github.com: https://github.com/symfony/ux/commit/95e878d5257f13d6d652ca95e3ef6bb0934d674f github.com: https://github.com/symfony/ux/releases/tag/v2.36.0 github.com: https://github.com/symfony/ux/releases/tag/v3.1.0