StackRadarChart IndexLive demo

CVE-2026-45304

Medium

Advisory

Published 27 May 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.9; base score, highest
EPSS: 0.007; 51st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 92; of 17,781 indexed, latest versions
Container images: 79; deployed by those charts
Fix available: 2 of 2; affected packages

Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")

Carried by container images the latest versions of 92 of 17,781 indexed charts deploy, on 79 images.

Affected package	Affected versions	Fixed in	Images
symfony/yamlcomposer	v2.8.34, v3.2.6, v3.3.18, v3.4.14+31 more	5.4.52, 6.4.40, 7.4.12	78
symfony/symfonycomposer	v3.4.47	5.4.52	1

OSV records: GHSA-4qpc-3hr4-r2p4

Charts affected

92 by stars

Chart

Latest

Affected images

Radar Score

zabbixzabbix-community

1 of 5 See more

zabbix zabbix-community 7.1.0

1 of the 5 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
zabbix/zabbix-web-nginx-pgsql :ubuntu-7.0.23	7d4d58086515	symfony/yaml@v5.1.3	5.4.52

Open the chart page →

13,664

1 of 5 See more

zabbix cetic 3.1.3

1 of the 5 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
zabbix/zabbix-web-nginx-pgsql :ubuntu-6.0.8	99e9a090b516	symfony/yaml@v5.1.3	5.4.52

Open the chart page →

33,725

mauticone-acre-fund

1 of 3 See more

mautic one-acre-fund 0.1.7

1 of the 3 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
mautic/mautic :v4-apache	94ea4acf4049	symfony/yaml@v4.4.37	5.4.52

Open the chart page →

2,667

monicamonica

1 of 1 See more

monica monica 1.0.15

1 of the 1 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
ghcr.io/monicahq/monica-next :main	8be69156acbb	symfony/yaml@v7.3.2	7.4.12

Open the chart page →

5,634

zabbix-serveraekondratiev

1 of 4 See more

zabbix-server aekondratiev 1.0.6

1 of the 4 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
zabbix/zabbix-web-nginx-pgsql :ubuntu-5.4.6	01de79c31391	symfony/yaml@v5.1.3	5.4.52

Open the chart page →

30,668

invoiceninjainvoiceninja

1 of 5 See more

invoiceninja invoiceninja 0.10.2

1 of the 5 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
invoiceninja/invoiceninja :5.6.24	1437916dee01	symfony/yaml@v6.3.0	6.4.40

Open the chart page →

2,709

dolibarrcowboysysop

1 of 3 See more

dolibarr cowboysysop 9.0.3

1 of the 3 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
dolibarr/dolibarr :22.0.4	7ad88fc9b13c	symfony/yaml@v3.4.47	5.4.52

Open the chart page →

9,106

dolibarrhelmforge

1 of 3 See more

dolibarr helmforge 1.2.18

1 of the 3 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
dolibarr/dolibarr :24.0.0	69ec52e3b7ef	symfony/yaml@v3.4.47	5.4.52

Open the chart page →

4,109

repmanszpadel-charts

1 of 3 See more

repman szpadel-charts 3.52.17

1 of the 3 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
buddy/repman :1.4.0	097c897f8b54	symfony/yaml@v5.4.2	5.4.52

Open the chart page →

7,052

brpservicebrpservice

1 of 4 See more

brpservice brpservice 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/brpservice-php :latest	c17f1ba17d36	symfony/yaml@v5.1.11	5.4.52

Open the chart page →

7,830

typo3christianhuth

1 of 2 See more

typo3 christianhuth 7.7.0

1 of the 2 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
martinhelmich/typo3 :12.4	c83a4f3fd7ae	symfony/yaml@v6.4.26	6.4.40

Open the chart page →

8,466

commonground-gatewaycommonground-gateway

1 of 7 See more

commonground-gateway commonground-gateway 1.5.4

1 of the 7 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/commonground-gateway-php :latest	947882bf2c37	symfony/yaml@v5.3.11	5.4.52

Open the chart page →

9,724

contactcataloguscontact-catalogus

1 of 3 See more

contactcatalogus contact-catalogus 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/contactcatalogus-php :latest	eeb625bd660c	symfony/yaml@v5.3.14	5.4.52

Open the chart page →

7,303

digispoof-interfacedigispoof-interface

1 of 3 See more

digispoof-interface digispoof-interface 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/digispoof-interface-php :latest	03aba499950f	symfony/yaml@v5.3.11	5.4.52

Open the chart page →

7,779

jumpdjjudas21

1 of 1 See more

jump djjudas21 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
daledavies/jump :v1.4.1	0a0c8ad93902	symfony/yaml@v5.4.35	5.4.52

Open the chart page →

728

zabbix-server-mysqlfermosit

1 of 4 See more

zabbix-server-mysql fermosit 3.0.2

1 of the 4 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
zabbix/zabbix-web-nginx-mysql :ubuntu-6.4-latest	0e5f69c4c54e	symfony/yaml@v5.1.3	5.4.52

Open the chart page →

12,840

baikalgeek-cookbook

1 of 1 See more

baikal geek-cookbook 5.2.0

1 of the 1 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
ckulka/baikal :0.8.0	aedb1f4f3fa0	symfony/yaml@v3.4.47	5.4.52

Open the chart page →

1,683

landelijketabellencataloguslandelijketabellencatalogus

1 of 3 See more

landelijketabellencatalogus landelijketabellencatalogus 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/landelijketabellencatalogus-php :latest	26d91dcbba56	symfony/yaml@v5.3.2	5.4.52

Open the chart page →

7,510

librenmsmidokura-community

1 of 6 See more

librenms midokura-community 0.3.2

1 of the 6 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
librenms/librenms :22.4.1	4f1f3d667cc7	symfony/yaml@v4.4.36	5.4.52

Open the chart page →

8,967

opencatalogiopencatalogi

1 of 8 See more

opencatalogi opencatalogi 1.0.6

1 of the 8 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/commonground-gateway-php :latest	947882bf2c37	symfony/yaml@v5.3.11	5.4.52

Open the chart page →

14,838

repmanrepman-helmchart

1 of 3 See more

repman repman-helmchart 1.0.12

1 of the 3 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
buddy/repman :1.4.0	097c897f8b54	symfony/yaml@v5.4.2	5.4.52

Open the chart page →

3,596

baikalrubxkube

1 of 1 See more

baikal rubxkube 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
ckulka/baikal :0.10.1-nginx	434bdd162247	symfony/yaml@v6.4.13	6.4.40

Open the chart page →

5,315

user-componentuser-component

1 of 4 See more

user-component user-component 1.2.0

1 of the 4 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/user-component-php :latest	198db44fabb5	symfony/yaml@v5.3.11	5.4.52

Open the chart page →

7,303

waardepapierenwaardepapieren

1 of 3 See more

waardepapieren waardepapieren 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/waardepapieren-php :latest	b2666ffcbad8	symfony/yaml@v5.3.3	5.4.52

Open the chart page →

8,079

waardepapieren-baliewaardepapieren-balie

1 of 3 See more

waardepapieren-balie waardepapieren-balie 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/waardepapieren-balie-php :latest	f36c423cd259	symfony/yaml@v5.3.3	5.4.52

Open the chart page →

7,871

waardepapieren-registerwaardepapieren-register

1 of 4 See more

waardepapieren-register waardepapieren-register 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/waardepapieren-register-php :latest	9affab218351	symfony/yaml@v5.3.3	5.4.52

Open the chart page →

7,429

redirectwyrihaximusnet

1 of 1 See more

redirect wyrihaximusnet 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
ghcr.io/wyrihaximusnet/redirect :random	bf5983d754d7	symfony/yaml@v7.1.5	7.4.12

Open the chart page →

1,581

linkstackadnoctem

1 of 1 See more

linkstack adnoctem 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
linkstackorg/linkstack :latest	1c8b05399ee4	symfony/yaml@v6.0.19	6.4.40

Open the chart page →

2,092

adresserviceadresservice

1 of 5 See more

adresservice adresservice 1.1.0

1 of the 5 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/adresservice-php :latest	c5075f0320cd	symfony/yaml@v5.3.3	5.4.52

Open the chart page →

7,447

agendaserviceagendaservice

1 of 3 See more

agendaservice agendaservice 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
conduction/agendaservice-php :latest	9cfeeb6c7c20	symfony/yaml@v5.1.10	5.4.52

Open the chart page →

7,209

satisfyanapsix

1 of 1 See more

satisfy anapsix 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
anapsix/satisfydigest-pinned	fae78e3809e9	symfony/yaml@v3.4.14	5.4.52

Open the chart page →

1,572

authorization-componentauthorization-component

1 of 3 See more

authorization-component authorization-component 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/authorization-component-php :latest	94a749392fcf	symfony/yaml@v5.3.2	5.4.52

Open the chart page →

7,561

balance-registrationbalance-registration

1 of 4 See more

balance-registration balance-registration 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
conduction/balance-registration-php :dev	c36094a41369	symfony/yaml@v5.1.10	5.4.52

Open the chart page →

8,408

berichtserviceberichtservice

1 of 3 See more

berichtservice berichtservice 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/berichtservice-php :latest	ee6a21e66ff0	symfony/yaml@v5.3.14	5.4.52

Open the chart page →

7,342

1 of 1 See more

drupal cetic 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
library/drupal :8-apache	8a1a3ee83899	symfony/yaml@v3.4.41	5.4.52

Open the chart page →

2,504

checkin-componentcheckin-component

1 of 4 See more

checkin-component checkin-component 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
conduction/checkin-component-php :dev	3423845692c1	symfony/yaml@v5.1.10	5.4.52

Open the chart page →

8,408

satisfycloudnativeapp

1 of 1 See more

satisfy cloudnativeapp 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
anapsix/satisfydigest-pinned	fae78e3809e9	symfony/yaml@v3.4.14	5.4.52

Open the chart page →

1,572

nextcloudcloudve

1 of 2 See more

nextcloud cloudve 1.13.0

1 of the 2 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
library/nextcloud :17.0.0-apache	96104cb965fc	symfony/yaml@v3.2.6	5.4.52

Open the chart page →

3,016

commonground-gatewaycommonground-gateway-frontend

1 of 4 See more

commonground-gateway commonground-gateway-frontend 0.1.5

1 of the 4 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/commonground-gateway-php :latest	947882bf2c37	symfony/yaml@v5.3.11	5.4.52

Open the chart page →

2,825

cgrccommongroundregistratiecomponent

1 of 3 See more

cgrc commongroundregistratiecomponent 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
conduction/cgrc-php :dev	25415534d245	symfony/yaml@v4.3.4	5.4.52

Open the chart page →

7,572

conduction-uiconduction-ui

1 of 6 See more

conduction-ui conduction-ui 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
conduction/conduction-ui-php :dev	2744565516e8	symfony/yaml@v5.1.11	5.4.52

Open the chart page →

12,907

betaalservicecontacten-catalog

1 of 3 See more

betaalservice contacten-catalog 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
conduction/betaalservice-php :latest	ece1ab544c57	symfony/yaml@v5.1.10	5.4.52

Open the chart page →

7,209

contactmoment-componentcontactmoment-component

1 of 4 See more

contactmoment-component contactmoment-component 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
conduction/contactmoment-component-php :dev	e1d4ad1e22a8	symfony/yaml@v5.1.8	5.4.52

Open the chart page →

8,408

mauticdevtron

1 of 3 See more

mautic devtron 0.1.3

1 of the 3 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
mautic/mautic :2.13-apache	a954c5868d76	symfony/yaml@v2.8.34	5.4.52

Open the chart page →

2,939

mauticdevtron-labs

1 of 3 See more

mautic devtron-labs 0.1.3

1 of the 3 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
mautic/mautic :2.13-apache	a954c5868d76	symfony/yaml@v2.8.34	5.4.52

Open the chart page →

2,939

docparserdocparser

1 of 4 See more

docparser docparser 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
conduction/docparser-php :dev	b6f95c8ead7d	symfony/yaml@v5.1.10	5.4.52

Open the chart page →

8,408

eav-componenteav-component

1 of 3 See more

eav-component eav-component 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/eav-component-php :latest	24bbca4a52a8	symfony/yaml@v5.3.14	5.4.52

Open the chart page →

7,255

education-componenteducation-component

1 of 3 See more

education-component education-component 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/education-component-php :latest	da6b05a1a601	symfony/yaml@v5.3.14	5.4.52

Open the chart page →

7,327

heimdallegeback

1 of 1 See more

heimdall egeback 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
linuxserver/heimdall :2.6.3	71597f4461e4	symfony/yaml@v6.4.3	6.4.40

Open the chart page →

1,664

eherkenning-uieherkenning-ui

1 of 3 See more

eherkenning-ui eherkenning-ui 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-45304.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/eherkenning-ui-php :latest	deed102b4255	symfony/yaml@v5.3.3	5.4.52

Open the chart page →

7,510

Container images carrying it

79 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/conductionnl/eherkenning-ui-php :latest	deed102b4255	symfony/yaml@v5.3.3	5.4.52	1
ghcr.io/conductionnl/grafregistratiecomponent-php :latest	35225eaa87ab	symfony/yaml@v5.3.3	5.4.52	1
ghcr.io/conductionnl/instemmingservice-php :latest	4ffe222b3e3a	symfony/yaml@v5.3.2	5.4.52	1
ghcr.io/conductionnl/landelijketabellencatalogus-php :latest	26d91dcbba56	symfony/yaml@v5.3.2	5.4.52	1
ghcr.io/conductionnl/loggingcomponent-php :latest	834b8e1af290	symfony/yaml@v5.3.2	5.4.52	1
ghcr.io/conductionnl/logicservice-php :latest	72aae2080595	symfony/yaml@v5.1.11	5.4.52	1
ghcr.io/conductionnl/medewerkercatalogus-php :latest	1ea5412bed26	symfony/yaml@v5.3.14	5.4.52	1
ghcr.io/conductionnl/memo-component-php :latest	ef77f4c089a1	symfony/yaml@v5.3.2	5.4.52	1
ghcr.io/conductionnl/notification-component-php :latest	cd9656e6bc2c	symfony/yaml@v5.1.0	5.4.52	1
ghcr.io/conductionnl/ocatiecatalogus-php :latest	c22764cbfa97	symfony/yaml@v5.3.2	5.4.52	1
ghcr.io/conductionnl/orderregistratiecomponent-php :latest	d17257e4fa27	symfony/yaml@v5.3.2	5.4.52	1
ghcr.io/conductionnl/procestypecatalogus-php :latest	956c4fb64796	symfony/yaml@v5.3.2	5.4.52	1
ghcr.io/conductionnl/productenendienstencatalogus-php :latest	7242da105081	symfony/yaml@v5.3.2	5.4.52	1
ghcr.io/conductionnl/proto-component-commonground-php :latest	eb36ead1954e	symfony/yaml@v5.3.2	5.4.52	1
ghcr.io/conductionnl/review-component-php :latest	afe623824b82	symfony/yaml@v5.3.6	5.4.52	1
ghcr.io/conductionnl/taalhuizen-service-php :latest	04f1b7f0d573	symfony/yaml@v5.3.6	5.4.52	1
ghcr.io/conductionnl/trouw-service-php :latest	f745e2870692	symfony/yaml@v5.3.2	5.4.52	1
ghcr.io/conductionnl/user-component-php :latest	198db44fabb5	symfony/yaml@v5.3.11	5.4.52	1
ghcr.io/conductionnl/verhuis-service-php :latest	66bbaf95a123	symfony/yaml@v5.3.3	5.4.52	1
ghcr.io/conductionnl/verzoekconversieservice-php :latest	e918014fb8d3	symfony/yaml@v5.3.3	5.4.52	1
ghcr.io/conductionnl/verzoekregistratiecomponent-php :latest	c4f6c03af5d3	symfony/yaml@v5.3.2	5.4.52	1
ghcr.io/conductionnl/verzoektypecatalogus-php :latest	64f5eb7a398b	symfony/yaml@v5.3.2	5.4.52	1
ghcr.io/conductionnl/waardepapieren-balie-php :latest	f36c423cd259	symfony/yaml@v5.3.3	5.4.52	1
ghcr.io/conductionnl/waardepapieren-php :latest	b2666ffcbad8	symfony/yaml@v5.3.3	5.4.52	1
ghcr.io/conductionnl/waardepapieren-register-php :latest	9affab218351	symfony/yaml@v5.3.3	5.4.52	1
ghcr.io/conductionnl/webresourcecatalogus-php :latest	8f1bbd5cda85	symfony/yaml@v5.3.14	5.4.52	1
ghcr.io/monicahq/monica-next :main	8be69156acbb	symfony/yaml@v7.3.2	7.4.12	1
ghcr.io/wbstack/api :8x.9.11	eee94f9f7a53	symfony/yaml@v5.4.3	5.4.52	1
ghcr.io/wyrihaximusnet/redirect :random	bf5983d754d7	symfony/yaml@v7.1.5	7.4.12	1