symfony/json-path Security Advisories (2)
-
Incomplete Fix for CVE-2026-45756: JsonPath Queries Can Still Hold a Process Through search(), match() and Chained Filters
Affected version: >=7.3.0,<7.4.0|>=7.4.0,<7.4.23|>=8.0.0,<8.1.0|>=8.1.0,<8.1.11
Reported by:
FriendsOfPHP/security-advisories -
[LOW] CVE-2026-45756: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits: ReDoS
PKSA-rj1d-mpts-8wrt CVE-2026-45756 GHSA-8v8v-g73j-492j
Affected version: >=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
Reported by:
GitHub, FriendsOfPHP/security-advisories