{"id":"CVE-2026-49209","title":"symfony/ux-live-component: Denial of service via unbounded batch action requests","summary":"symfony/ux-live-component: Denial of service via unbounded batch action requests","severity":"low","cwe":["CWE-770"],"vendor":"symfony","product":"symfony/ux-live-component","affected":["symfony/ux-live-component >= 2.5.0, < 2.36.0","symfony/ux-live-component >= 3.0.0, < 3.1.0"],"patched":["symfony/ux-live-component 2.36.0","symfony/ux-live-component 3.1.0"],"published":"2026-06-19","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-mm82-c99c-h2cf","references":[{"url":"https://github.com/symfony/ux/security/advisories/GHSA-mm82-c99c-h2cf"},{"url":"https://github.com/symfony/ux/commit/95e878d5257f13d6d652ca95e3ef6bb0934d674f"},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/ux-live-component/CVE-2026-49209.yaml"},{"url":"https://github.com/advisories/GHSA-mm82-c99c-h2cf"}],"tags":["ghsa","composer"],"ingestedAt":"2026-06-22T15:52:21.067Z","ecosystem":"composer","epss":0.0056,"epssPercentile":0.45438,"slug":"CVE-2026-49209","body":"## Overview\n\n### Description\n\n`Symfony\\UX\\LiveComponent\\Controller\\BatchActionController::__invoke()` iterates over the client-supplied `actions` array and issues a full `HttpKernel` sub-request for each entry (event subscribers, validators, Doctrine, rendering). The array size is never bounded, so an authenticated client can submit a single `_batch` request containing thousands of actions and exhaust CPU, memory, and database connections on the application server.\n\n### Resolution\n\n`BatchActionController` now enforces an upper bound of 50 actions per `_batch` request (`MAX_ACTIONS_PER_BATCH`) and rejects larger payloads up front with a `BadRequestHttpException`. The matching JavaScript backend was also updated to split larger client-side batches into multiple requests so legitimate usage isn't affected.\n\nThe patch for this issue is available [here](https://github.com/symfony/ux/commit/95e878d5257f13d6d652ca95e3ef6bb0934d674f) for branch 2.x (and forward-ported to 3.x).\n\n### Credits\n\nSymfony would like to thank Pascal Cescon for reporting the issue and Hugo Alliaume for providing the fix.\n\n## Affected packages\n\n- `symfony/ux-live-component >= 2.5.0, < 2.36.0`\n- `symfony/ux-live-component >= 3.0.0, < 3.1.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `symfony/ux-live-component 2.36.0`\n- `symfony/ux-live-component 3.1.0`","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}