Description "Symfony\Component\Yaml\Parser::cleanup()" strips the optional "%YAML" directive header, leading comments, and document start/end markers before parsing. The original regexes contained overlapping quantifiers, most notably "'#^%YAML[: ][\d.]+.\n#u'", whose "[\d.]+" and "." overlap on the dot, that exhibit catastrophic backtracking on crafted input. A single oversized "%YAML" directive header (or comment / document-marker line) makes the parser hang for an arbitrarily long time, denying service. Resolution The four regexes in "Parser::cleanup()" (YAML directive header, leading comments, document-start marker, document-end marker) have been rewritten with possessive quantifiers and unambiguous character classes so backtracking cannot occur. The patch for this issue is available "here" (https://github.com/symfony/symfony/commit/9749cd43c5e09b3735093623670b21b9d8a056cb) for branch 5.4. Credits Symfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it.