CVE-2026-108082 (GCVE-0-2026-108082)
Vulnerability from cvelistv5 – Published: 2026-10-15 14:46 – Updated: 2026-10-15 18:04
VLAI
EPSS
VEX
Title
Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header
Summary
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication.
A single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped.
This issue affects symfony/http-foundation v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through v6.4.45, v7.0.0-BETA1 through v7.4.18, and v8.0.0-BETA1 through v8.1.6.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 18:04 UTC
CWE
- CWE-1333 - Inefficient regular expression complexity
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/symfony/symfony/pull/66048 | patch |
| https://github.com/symfony/symfony/pull/66491 | patch |
| https://github.com/symfony/symfony/security/advis… | vendor-advisory |
| https://symfony.com/blog/cve-2026-108082-redos-in… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| sensiolabs | symfony |
Affected:
v4.1.0-BETA1 , < v5.4.54
(git)
Affected: v6.0.0-BETA1 , < v6.4.46 (git) Affected: v7.0.0-BETA1 , < v7.4.19 (git) Affected: v8.0.0-BETA1 , < v8.1.7 (git) cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* |
Date Public
2026-09-14 11:59
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108082",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T18:04:09.776300Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:04:45.913Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/packages/symfony/http-foundation",
"defaultStatus": "unaffected",
"modules": [
"Symfony\\Component\\HttpFoundation\\HeaderUtils::split()"
],
"packageName": "symfony/http-foundation",
"product": "symfony",
"repo": "https://github.com/symfony/http-foundation",
"vendor": "sensiolabs",
"versions": [
{
"lessThan": "v5.4.54",
"status": "affected",
"version": "v4.1.0-BETA1",
"versionType": "git"
},
{
"lessThan": "v6.4.46",
"status": "affected",
"version": "v6.0.0-BETA1",
"versionType": "git"
},
{
"lessThan": "v7.4.19",
"status": "affected",
"version": "v7.0.0-BETA1",
"versionType": "git"
},
{
"lessThan": "v8.1.7",
"status": "affected",
"version": "v8.0.0-BETA1",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v5.4.54",
"versionStartIncluding": "v4.1.0-beta1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v6.4.46",
"versionStartIncluding": "v6.0.0-beta1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v7.4.19",
"versionStartIncluding": "v7.0.0-beta1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v8.1.7",
"versionStartIncluding": "v8.0.0-beta1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "r3verii"
},
{
"lang": "en",
"type": "other",
"value": "Duarte Santos"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nicolas Grekas"
}
],
"datePublic": "2026-09-14T11:59:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSymfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions\u0026nbsp;\u003cspan\u003e5.4.54,\u0026nbsp;\u003c/span\u003e\u003cspan\u003e6.4.46,\u0026nbsp;\u003c/span\u003e\u003cspan\u003e7.4.19, and\u0026nbsp;\u003c/span\u003e\u003cspan\u003e8.1.7,\u0026nbsp;\u003c/span\u003e\u003ccode\u003eHeaderUtils::split()\u003c/code\u003e\u003cspan\u003e parsed header values with a pattern whose token alternative also matched whitespace, followed by a \u003c/span\u003e\u003ccode\u003e(?\u0026lt;!\\s)\u003c/code\u003e\u003cspan\u003e lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. \u003c/span\u003e\u003ccode\u003eHeaderBag\u003c/code\u003e\u003cspan\u003e calls it for the \u003c/span\u003e\u003ccode\u003eCache-Control\u003c/code\u003e\u003cspan\u003e header whenever a \u003c/span\u003e\u003ccode\u003eRequest\u003c/code\u003e\u003cspan\u003e is built, so any application handling HTTP requests is reachable, with no authentication.\u003c/span\u003e\u003c/p\u003e\u003cp\u003eA single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, \u003ccode\u003epreg_match_all()\u003c/code\u003e gives up at \u003ccode\u003epcre.backtrack_limit\u003c/code\u003e and \u003ccode\u003esplit()\u003c/code\u003e returns an empty array, so every directive of the header is silently dropped.\u003c/p\u003e\u003cp\u003eThis issue affects \u003ccode\u003esymfony/http-foundation\u003c/code\u003e\u0026nbsp;v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through\u0026nbsp;v6.4.45, v7.0.0-BETA1 through\u0026nbsp;v7.4.18, and v8.0.0-BETA1 through\u0026nbsp;v8.1.6.\u003c/p\u003e"
}
],
"value": "Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions\u00a05.4.54,\u00a06.4.46,\u00a07.4.19, and\u00a08.1.7,\u00a0HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?\u003c!\\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication.\n\n\n\nA single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped.\n\n\n\nThis issue affects symfony/http-foundation\u00a0v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through\u00a0v6.4.45, v7.0.0-BETA1 through\u00a0v7.4.18, and v8.0.0-BETA1 through\u00a0v8.1.6."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "CWE-1333 Inefficient regular expression complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:32:05.788Z",
"orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"shortName": "Checkmarx"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/symfony/symfony/pull/66048"
},
{
"tags": [
"patch"
],
"url": "https://github.com/symfony/symfony/pull/66491"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/symfony/symfony/security/advisories/GHSA-r925-mgvr-h9cc"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://symfony.com/blog/cve-2026-108082-redos-in-headerutils-split-reachable-through-the-cache-control-request-header"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"assignerShortName": "Checkmarx",
"cveId": "CVE-2026-108082",
"datePublished": "2026-10-15T14:46:01.594Z",
"dateReserved": "2026-10-09T12:09:17.141Z",
"dateUpdated": "2026-10-15T18:04:45.913Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-108082",
"date": "2026-10-16",
"epss": "0.00367",
"percentile": "0.28963"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"collectionURL": "https://packagist.org/packages/symfony/http-foundation",
"defaultStatus": "unaffected",
"modules": [
"Symfony\\Component\\HttpFoundation\\HeaderUtils::split()"
],
"packageName": "symfony/http-foundation",
"product": "symfony",
"repo": "https://github.com/symfony/http-foundation",
"vendor": "sensiolabs",
"versions": [
{
"lessThan": "v5.4.54",
"status": "affected",
"version": "v4.1.0-BETA1",
"versionType": "git"
},
{
"lessThan": "v6.4.46",
"status": "affected",
"version": "v6.0.0-BETA1",
"versionType": "git"
},
{
"lessThan": "v7.4.19",
"status": "affected",
"version": "v7.0.0-BETA1",
"versionType": "git"
},
{
"lessThan": "v8.1.7",
"status": "affected",
"version": "v8.0.0-BETA1",
"versionType": "git"
}
]
}
],
"source": "596c5446-0ce5-4ba2-aa66-48b3b757a647"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions\u00a05.4.54,\u00a06.4.46,\u00a07.4.19, and\u00a08.1.7,\u00a0HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?\u003c!\\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication.\n\n\n\nA single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped.\n\n\n\nThis issue affects symfony/http-foundation\u00a0v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through\u00a0v6.4.45, v7.0.0-BETA1 through\u00a0v7.4.18, and v8.0.0-BETA1 through\u00a0v8.1.6."
}
],
"id": "CVE-2026-108082",
"lastModified": "2026-10-16T16:00:33.533",
"metrics": {
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-108082",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T18:04:09.776300Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-10-15T15:17:22.583",
"references": [
{
"source": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"url": "https://github.com/symfony/symfony/pull/66048"
},
{
"source": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"url": "https://github.com/symfony/symfony/pull/66491"
},
{
"source": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"url": "https://github.com/symfony/symfony/security/advisories/GHSA-r925-mgvr-h9cc"
},
{
"source": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"url": "https://symfony.com/blog/cve-2026-108082-redos-in-headerutils-split-reachable-through-the-cache-control-request-header"
}
],
"sourceIdentifier": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-1333"
}
],
"source": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108082",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T18:04:09.776300Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:04:15.454Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/packages/symfony/http-foundation",
"defaultStatus": "unaffected",
"modules": [
"Symfony\\Component\\HttpFoundation\\HeaderUtils::split()"
],
"packageName": "symfony/http-foundation",
"product": "symfony",
"repo": "https://github.com/symfony/http-foundation",
"vendor": "sensiolabs",
"versions": [
{
"lessThan": "v5.4.54",
"status": "affected",
"version": "v4.1.0-BETA1",
"versionType": "git"
},
{
"lessThan": "v6.4.46",
"status": "affected",
"version": "v6.0.0-BETA1",
"versionType": "git"
},
{
"lessThan": "v7.4.19",
"status": "affected",
"version": "v7.0.0-BETA1",
"versionType": "git"
},
{
"lessThan": "v8.1.7",
"status": "affected",
"version": "v8.0.0-BETA1",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v5.4.54",
"versionStartIncluding": "v4.1.0-beta1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v6.4.46",
"versionStartIncluding": "v6.0.0-beta1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v7.4.19",
"versionStartIncluding": "v7.0.0-beta1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v8.1.7",
"versionStartIncluding": "v8.0.0-beta1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "r3verii"
},
{
"lang": "en",
"type": "other",
"value": "Duarte Santos"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nicolas Grekas"
}
],
"datePublic": "2026-09-14T11:59:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSymfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions\u0026nbsp;\u003cspan\u003e5.4.54,\u0026nbsp;\u003c/span\u003e\u003cspan\u003e6.4.46,\u0026nbsp;\u003c/span\u003e\u003cspan\u003e7.4.19, and\u0026nbsp;\u003c/span\u003e\u003cspan\u003e8.1.7,\u0026nbsp;\u003c/span\u003e\u003ccode\u003eHeaderUtils::split()\u003c/code\u003e\u003cspan\u003e parsed header values with a pattern whose token alternative also matched whitespace, followed by a \u003c/span\u003e\u003ccode\u003e(?\u0026lt;!\\s)\u003c/code\u003e\u003cspan\u003e lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. \u003c/span\u003e\u003ccode\u003eHeaderBag\u003c/code\u003e\u003cspan\u003e calls it for the \u003c/span\u003e\u003ccode\u003eCache-Control\u003c/code\u003e\u003cspan\u003e header whenever a \u003c/span\u003e\u003ccode\u003eRequest\u003c/code\u003e\u003cspan\u003e is built, so any application handling HTTP requests is reachable, with no authentication.\u003c/span\u003e\u003c/p\u003e\u003cp\u003eA single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, \u003ccode\u003epreg_match_all()\u003c/code\u003e gives up at \u003ccode\u003epcre.backtrack_limit\u003c/code\u003e and \u003ccode\u003esplit()\u003c/code\u003e returns an empty array, so every directive of the header is silently dropped.\u003c/p\u003e\u003cp\u003eThis issue affects \u003ccode\u003esymfony/http-foundation\u003c/code\u003e\u0026nbsp;v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through\u0026nbsp;v6.4.45, v7.0.0-BETA1 through\u0026nbsp;v7.4.18, and v8.0.0-BETA1 through\u0026nbsp;v8.1.6.\u003c/p\u003e"
}
],
"value": "Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions\u00a05.4.54,\u00a06.4.46,\u00a07.4.19, and\u00a08.1.7,\u00a0HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?\u003c!\\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication.\n\n\n\nA single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped.\n\n\n\nThis issue affects symfony/http-foundation\u00a0v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through\u00a0v6.4.45, v7.0.0-BETA1 through\u00a0v7.4.18, and v8.0.0-BETA1 through\u00a0v8.1.6."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "CWE-1333 Inefficient regular expression complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:32:05.788Z",
"orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"shortName": "Checkmarx"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/symfony/symfony/pull/66048"
},
{
"tags": [
"patch"
],
"url": "https://github.com/symfony/symfony/pull/66491"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/symfony/symfony/security/advisories/GHSA-r925-mgvr-h9cc"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://symfony.com/blog/cve-2026-108082-redos-in-headerutils-split-reachable-through-the-cache-control-request-header"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"assignerShortName": "Checkmarx",
"cveId": "CVE-2026-108082",
"datePublished": "2026-10-15T14:46:01.594Z",
"dateReserved": "2026-10-09T12:09:17.141Z",
"dateUpdated": "2026-10-15T18:04:45.913Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.