PatchSiren cyber security CVE debrief
CVE-2026-49209 symfony CVE debrief
CVE-2026-49209 is a denial of service vulnerability in Symfony UX LiveComponent BatchActionController. An authenticated client can submit a single _batch request containing thousands of actions and exhaust CPU, memory, and database connections on the application server. This issue affects users of Symfony UX LiveComponent version 2.5.0 through 2.36.0 and 3.1.0.
- Vendor
- symfony
- Product
- ux
- CVSS
- MEDIUM 5.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-17
- Original CVE updated
- 2026-07-17
- Advisory published
- 2026-07-17
- Advisory updated
- 2026-07-17
Who should care
Users of Symfony UX LiveComponent version 2.5.0 through 2.36.0 and 3.1.0 should apply patches to prevent denial of service attacks. System administrators and security teams responsible for Symfony UX LiveComponent deployments should review and implement necessary mitigations.
Technical summary
The __invoke() method in Symfony UX LiveComponent's BatchActionController iterates over a client-supplied actions array without bounding its size. This allows an authenticated attacker to submit a _batch request with numerous actions, potentially exhausting server resources. The vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity. Affected users of Symfony UX LiveComponent version 2.5.0 through 2.36.0 and 3.1.0 should apply patches to prevent denial of service attacks. The issue can be mitigated by implementing rate limiting on _batch requests, monitoring server resource utilization, and restricting authenticated user permissions.
Defensive priority
Medium priority due to the CVSS score of 5.3 and potential for resource exhaustion.
Recommended defensive actions
- Apply patches to upgrade Symfony UX LiveComponent to version 2.36.0 or 3.1.0.
- Implement rate limiting on _batch requests.
- Monitor server resource utilization.
- Restrict authenticated user permissions.
- Review compensating controls for exposed systems while remediation is scheduled and verified.
- Check relevant monitoring, detection, and logs for exposed assets that need extra review.
- Track exceptions, retest remediated assets, and close the item only after evidence is documented.
Evidence notes
The CVE record was published on 2026-07-17T17:17:15.517Z and last modified on 2026-07-17T18:17:16.590Z. The NVD entry is currently Undergoing Analysis. Evidence is limited to CVE and NVD details. Defenders should verify affected scope and vendor guidance.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-17T17:17:15.517Z and has not been modified since then. The NVD entry is currently Undergoing Analysis.