The Symfony Yaml component is affected by inefficient algorithmic complexity (CWE-407, CWE-1333) when parsing untrusted YAML. Certain documents are parsed in time that grows exponentially or quadratically with their size, so a small crafted document can keep a PHP process busy for seconds or minutes and consume large amounts of memory. Examples include an embedded mapping in a flow sequence being re-parsed for every appended scalar, flow-collection scalars being matched against copies of the rest of the collection, and key/tag/comment patterns scanning a run of spaces once per character. Any code parsing untrusted YAML with the default flags is affected; on Symfony 7.4 and later this includes the #[MapRequestPayload] attribute when the Yaml component is installed and the endpoint does not restrict acceptFormat, so a single unauthenticated request carrying a YAML (or JSON, which is valid YAML) body can hold a PHP worker until max_execution_time, resulting in denial of service. The issue is fixed in Symfony Yaml 5.4.56, 6.4.50, 7.4.23 and 8.1.11.