CVE-2026-49209Low▾ Sunlitsymfony/ux-live-component: Denial of service via unbounded batch action requests
▾ Sunlit zone — Low / medium · no exploitation signal
impact 13.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.3%
0.3% → 0.6%
Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke() iterates over the client-supplied actions array and issues a full HttpKernel sub-request for each entry (event subscribers, validators, Doctrine, rendering). The array size is never bounded, so an authenticated client can submit a single _batch request containing thousands of actions and exhaust CPU, memory, and database connections on the application server.
BatchActionController now enforces an upper bound of 50 actions per _batch request (MAX_ACTIONS_PER_BATCH) and rejects larger payloads up front with a BadRequestHttpException. The matching JavaScript backend was also updated to split larger client-side batches into multiple requests so legitimate usage isn't affected.
The patch for this issue is available here for branch 2.x (and forward-ported to 3.x).
Symfony would like to thank Pascal Cescon for reporting the issue and Hugo Alliaume for providing the fix.
symfony/ux-live-component >= 2.5.0, < 2.36.0symfony/ux-live-component >= 3.0.0, < 3.1.0Upgrade to a patched release:
symfony/ux-live-component 2.36.0symfony/ux-live-component 3.1.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-49208Mediumux-live-component: Format-less date LiveProps parsed with the permissive DateTime constructor
CVE-2026-49210Mediumsymfony/ux-live-component: XSS via attacker-controlled child component tag
CVE-2026-49212Lowsymfony/ux-live-component: LiveComponentHydrator HMAC checksum lacks component and slot binding
CVE-2026-49215Lowsymfony/ux-live-component: CSRF Protection Bypass — Accept Header is CORS-Safelisted
CVE-2026-16100Medium· 6.5A flaw was found in the user-event metrics recording of Keycloak
CVE-2025-11362High· 7.5Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding