A denial-of-service vulnerability was found in the Symfony YAML component (symfony/yaml). Parsing certain crafted YAML documents takes time, and in some cases memory, that grows disproportionately to the size of the input (inefficient algorithmic complexity). A small untrusted document can therefore keep a PHP process busy until the configured max_execution_time, denying service. Any code that parses untrusted YAML with the default flags is affected; on Symfony 7.4 and later this includes endpoints using #[MapRequestPayload] when the Yaml component is installed and the endpoint does not restrict the accepted format. This issue is fixed in symfony/yaml 5.4.56, 6.4.50, 7.4.23, and 8.1.11.