{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"symfony","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":[],"id":"tcs_01M5NPW9MEG45BNVRPDX90M7AY","modified_at":"2026-10-23T17:47:28.599080247Z","published_at":"2026-10-15T16:17:43.963Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-109449","https://security-tracker.debian.org/tracker/CVE-2026-109449"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-109449#Debian:13/symfony","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-109449"}],"summary":"In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of"}