p PatchFirst

CVE-2026-108082

CVE-2026-108082 · Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication. A single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped. This issue affects symfony/http-foundation v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through v6.4.45, v7.0.0-BETA1 through v7.4.18, and v8.0.0-BETA1 through v8.1.6.

CVSS 8.7 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • symfony

    Versions
    • ≥ v4.1.0-BETA1, < v5.4.54: Affected (git)
    • ≥ v6.0.0-BETA1, < v6.4.46: Affected (git)
    • ≥ v7.0.0-BETA1, < v7.4.19: Affected (git)
    • ≥ v8.0.0-BETA1, < v8.1.7: Affected (git)

    Update to v5.4.54; Update to v6.4.46; Update to v7.4.19; Update to v8.1.7

  • symfony Debian:12

    Versions
    • 5.4.23+dfsg-1
    • 5.4.23+dfsg-1+deb12u1
    • 5.4.23+dfsg-1+deb12u2
    • 5.4.23+dfsg-1+deb12u3
    • 5.4.23+dfsg-1+deb12u4
    • 5.4.23+dfsg-1+deb12u5
    • 5.4.24+dfsg-1
    • 5.4.25+dfsg-1
    • 5.4.27+dfsg-1
    • 5.4.28+dfsg-1
    • 5.4.29+dfsg-1
    • 5.4.30+dfsg-1
    • 5.4.31+dfsg-1
    • 5.4.31+dfsg-2
    • 5.4.32+dfsg-1
    • 5.4.33+dfsg-1
    • 5.4.34+dfsg-1
    • 5.4.34+dfsg-2
    • 5.4.35+dfsg-1
    • 5.4.35+dfsg-2
    • 5.4.35+dfsg-3
    • 5.4.52+dfsg-0+deb12u1
    • 5.4.53+dfsg-0+deb12u1
    • 6.3.0+dfsg-1
    • 6.3.0~rc1+dfsg-1
    • 6.3.0~rc2+dfsg-1
    • 6.3.1+dfsg-1
    • 6.3.3+dfsg-1
    • 6.3.4+dfsg-1
    • 6.3.5+dfsg-1
    • 6.3.6+dfsg-1
    • 6.3.7+dfsg-1
    • 6.4.0+dfsg-1
    • 6.4.0~beta2+dfsg-1
    • 6.4.0~beta3+dfsg-1
    • 6.4.0~rc1+dfsg-1
    • 6.4.0~rc2+dfsg-1
    • 6.4.1+dfsg-1
    • 6.4.10+dfsg-1
    • 6.4.11+dfsg-1
    • 6.4.12+dfsg-1
    • 6.4.13+dfsg-1
    • 6.4.14+dfsg-1
    • 6.4.15+dfsg-1
    • 6.4.16+dfsg-1
    • 6.4.16+dfsg-2
    • 6.4.17+dfsg-1
    • 6.4.17+dfsg-2
    • 6.4.17+dfsg-3
    • 6.4.17+dfsg-4
    • 6.4.17+dfsg-5
    • 6.4.17+dfsg-6
    • 6.4.18+dfsg-1
    • 6.4.19+dfsg-1
    • 6.4.19+dfsg-2
    • 6.4.2+dfsg-1
    • 6.4.20+dfsg-1
    • 6.4.20+dfsg-2
    • 6.4.21+dfsg-1
    • 6.4.21+dfsg-2
    • 6.4.24+dfsg-1
    • 6.4.25+dfsg-1
    • 6.4.3+dfsg-1
    • 6.4.4+dfsg-1
    • 6.4.4+dfsg-2
    • 6.4.4+dfsg-3
    • 6.4.4+dfsg-4
    • 6.4.5+dfsg-1
    • 6.4.5+dfsg-2
    • 6.4.5+dfsg-3
    • 6.4.5+dfsg-4
    • 6.4.6+dfsg-1
    • 6.4.7+dfsg-1
    • 6.4.9+dfsg-1
    • 7.0.4+dfsg-1
    • 7.0.5+dfsg-1
    • 7.0.6+dfsg-1
    • 7.0.7+dfsg-1
    • 7.1.0~beta1+dfsg-1
    • 7.1.0~rc1+dfsg-1
    • 7.1.2+dfsg-1
    • 7.1.3+dfsg-1
    • 7.1.4+dfsg-1
    • 7.1.5+dfsg-1
    • 7.2.0~beta1+dfsg-1
    • 7.2.0~beta2+dfsg-1
    • 7.2.0~rc1+dfsg-1
    • 7.2.1+dfsg-1
    • 7.2.2+dfsg-1
    • 7.2.3+dfsg-1
    • 7.2.4+dfsg-1
    • 7.2.5+dfsg-1
    • 7.2.6-1
    • 7.3.0+dfsg-1
    • 7.3.0~beta1+dfsg-1
    • 7.3.0~beta2+dfsg-1
    • 7.3.0~rc1+dfsg-1
    • 7.3.1+dfsg-1
    • 7.3.2+dfsg-1
    • 7.3.3+dfsg-1
    • 7.3.4+dfsg-1
    • 7.3.5-1
    • 7.4.0+dfsg-1
    • 7.4.0+dfsg-2
    • 7.4.0~beta1-1
    • 7.4.0~beta1-2
    • 7.4.0~beta2+dfsg-1
    • 7.4.0~beta2+dfsg-2
    • 7.4.0~beta2+dfsg-3
    • 7.4.0~rc1+dfsg-1
    • 7.4.0~rc2+dfsg-1
    • 7.4.0~rc3+dfsg-1
    • 7.4.10+dfsg-1
    • 7.4.12+dfsg-1
    • 7.4.13+dfsg-1
    • 7.4.13+dfsg-2
    • 7.4.14+dfsg-1
    • 7.4.15+dfsg-1
    • 7.4.15+dfsg-2
    • 7.4.16+dfsg-1
    • 7.4.17+dfsg-1
    • 7.4.18+dfsg-1
    • 7.4.19+dfsg-1
    • 7.4.2+dfsg-1
    • 7.4.2+dfsg-2
    • 7.4.20+dfsg-1
    • 7.4.21+dfsg-1
    • 7.4.3+dfsg-1
    • 7.4.4+dfsg-1
    • 7.4.5+dfsg-1
    • 7.4.6+dfsg-1
    • 7.4.6+dfsg-2
    • 7.4.7+dfsg-1
    • 7.4.8+dfsg-1
    • 7.4.9+dfsg-1
    • 8.0.0+dfsg-1
    • 8.0.0~beta2+dfsg-1
    • 8.0.0~beta2+dfsg-2
    • 8.0.0~rc1+dfsg-1
    • 8.0.0~rc2+dfsg-1
    • 8.0.0~rc3+dfsg-1
    • 8.0.10-1
    • 8.0.11+dfsg-1
    • 8.0.12+dfsg-1
    • 8.0.13+dfsg-1
    • 8.0.2+dfsg-1
    • 8.0.3+dfsg-1
    • 8.0.4+dfsg-1
    • 8.0.5+dfsg-1
    • 8.0.6+dfsg-1
    • 8.0.7+dfsg-1
    • 8.0.8+dfsg-1
    • 8.0.9+dfsg-1
    • 8.1.0+dfsg-1
    • 8.1.1+dfsg-1
    • 8.1.3+dfsg-1
    • 8.1.4+dfsg-1
    • 8.1.5+dfsg-1
    • 8.1.6+dfsg-1
    • 8.1.7+dfsg-1
    • 8.1.8+dfsg-1
    • 8.1.9+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Debian:13

    Versions
    • 6.4.21+dfsg-2
    • 6.4.21+dfsg-2+deb13u1
    • 6.4.24+dfsg-1
    • 6.4.25+dfsg-1
    • 6.4.40+dfsg-0+deb13u1
    • 6.4.41+dfsg-0+deb13u1
    • 7.0.4+dfsg-1
    • 7.0.5+dfsg-1
    • 7.0.6+dfsg-1
    • 7.0.7+dfsg-1
    • 7.1.0~beta1+dfsg-1
    • 7.1.0~rc1+dfsg-1
    • 7.1.2+dfsg-1
    • 7.1.3+dfsg-1
    • 7.1.4+dfsg-1
    • 7.1.5+dfsg-1
    • 7.2.0~beta1+dfsg-1
    • 7.2.0~beta2+dfsg-1
    • 7.2.0~rc1+dfsg-1
    • 7.2.1+dfsg-1
    • 7.2.2+dfsg-1
    • 7.2.3+dfsg-1
    • 7.2.4+dfsg-1
    • 7.2.5+dfsg-1
    • 7.2.6-1
    • 7.3.0+dfsg-1
    • 7.3.0~beta1+dfsg-1
    • 7.3.0~beta2+dfsg-1
    • 7.3.0~rc1+dfsg-1
    • 7.3.1+dfsg-1
    • 7.3.2+dfsg-1
    • 7.3.3+dfsg-1
    • 7.3.4+dfsg-1
    • 7.3.5-1
    • 7.4.0+dfsg-1
    • 7.4.0+dfsg-2
    • 7.4.0~beta1-1
    • 7.4.0~beta1-2
    • 7.4.0~beta2+dfsg-1
    • 7.4.0~beta2+dfsg-2
    • 7.4.0~beta2+dfsg-3
    • 7.4.0~rc1+dfsg-1
    • 7.4.0~rc2+dfsg-1
    • 7.4.0~rc3+dfsg-1
    • 7.4.10+dfsg-1
    • 7.4.12+dfsg-1
    • 7.4.13+dfsg-1
    • 7.4.13+dfsg-2
    • 7.4.14+dfsg-1
    • 7.4.15+dfsg-1
    • 7.4.15+dfsg-2
    • 7.4.16+dfsg-1
    • 7.4.17+dfsg-1
    • 7.4.18+dfsg-1
    • 7.4.19+dfsg-1
    • 7.4.2+dfsg-1
    • 7.4.2+dfsg-2
    • 7.4.20+dfsg-1
    • 7.4.21+dfsg-1
    • 7.4.3+dfsg-1
    • 7.4.4+dfsg-1
    • 7.4.5+dfsg-1
    • 7.4.6+dfsg-1
    • 7.4.6+dfsg-2
    • 7.4.7+dfsg-1
    • 7.4.8+dfsg-1
    • 7.4.9+dfsg-1
    • 8.0.0+dfsg-1
    • 8.0.0~beta2+dfsg-1
    • 8.0.0~beta2+dfsg-2
    • 8.0.0~rc1+dfsg-1
    • 8.0.0~rc2+dfsg-1
    • 8.0.0~rc3+dfsg-1
    • 8.0.10-1
    • 8.0.11+dfsg-1
    • 8.0.12+dfsg-1
    • 8.0.13+dfsg-1
    • 8.0.2+dfsg-1
    • 8.0.3+dfsg-1
    • 8.0.4+dfsg-1
    • 8.0.5+dfsg-1
    • 8.0.6+dfsg-1
    • 8.0.7+dfsg-1
    • 8.0.8+dfsg-1
    • 8.0.9+dfsg-1
    • 8.1.0+dfsg-1
    • 8.1.1+dfsg-1
    • 8.1.3+dfsg-1
    • 8.1.4+dfsg-1
    • 8.1.5+dfsg-1
    • 8.1.6+dfsg-1
    • 8.1.7+dfsg-1
    • 8.1.8+dfsg-1
    • 8.1.9+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Debian:14

    Versions
    • 6.4.21+dfsg-2
    • 6.4.24+dfsg-1
    • 6.4.25+dfsg-1
    • 7.0.4+dfsg-1
    • 7.0.5+dfsg-1
    • 7.0.6+dfsg-1
    • 7.0.7+dfsg-1
    • 7.1.0~beta1+dfsg-1
    • 7.1.0~rc1+dfsg-1
    • 7.1.2+dfsg-1
    • 7.1.3+dfsg-1
    • 7.1.4+dfsg-1
    • 7.1.5+dfsg-1
    • 7.2.0~beta1+dfsg-1
    • 7.2.0~beta2+dfsg-1
    • 7.2.0~rc1+dfsg-1
    • 7.2.1+dfsg-1
    • 7.2.2+dfsg-1
    • 7.2.3+dfsg-1
    • 7.2.4+dfsg-1
    • 7.2.5+dfsg-1
    • 7.2.6-1
    • 7.3.0+dfsg-1
    • 7.3.0~beta1+dfsg-1
    • 7.3.0~beta2+dfsg-1
    • 7.3.0~rc1+dfsg-1
    • 7.3.1+dfsg-1
    • 7.3.2+dfsg-1
    • 7.3.3+dfsg-1
    • 7.3.4+dfsg-1
    • 7.3.5-1
    • 7.4.0+dfsg-1
    • 7.4.0+dfsg-2
    • 7.4.0~beta1-1
    • 7.4.0~beta1-2
    • 7.4.0~beta2+dfsg-1
    • 7.4.0~beta2+dfsg-2
    • 7.4.0~beta2+dfsg-3
    • 7.4.0~rc1+dfsg-1
    • 7.4.0~rc2+dfsg-1
    • 7.4.0~rc3+dfsg-1
    • 7.4.10+dfsg-1
    • 7.4.12+dfsg-1
    • 7.4.13+dfsg-1
    • 7.4.13+dfsg-2
    • 7.4.14+dfsg-1
    • 7.4.15+dfsg-1
    • 7.4.15+dfsg-2
    • 7.4.16+dfsg-1
    • 7.4.17+dfsg-1
    • 7.4.18+dfsg-1
    • 7.4.2+dfsg-1
    • 7.4.2+dfsg-2
    • 7.4.3+dfsg-1
    • 7.4.4+dfsg-1
    • 7.4.5+dfsg-1
    • 7.4.6+dfsg-1
    • 7.4.6+dfsg-2
    • 7.4.7+dfsg-1
    • 7.4.8+dfsg-1
    • 7.4.9+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 7.4.19+dfsg-1

    Update to 7.4.19+dfsg-1

  • symfony Ubuntu:16.04:LTS

    Versions
    • 2.7.1+dfsg-1
    • 2.7.5+dfsg-1
    • 2.7.9+dfsg-1
    • 2.7.9+dfsg-1ubuntu2
    • 2.7.10-0ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:Pro:18.04:LTS

    Versions
    • 2.8.7+dfsg-1.3ubuntu1
    • 3.4.3+dfsg-1ubuntu4
    • 3.4.6+dfsg-1
    • 3.4.6+dfsg-1ubuntu0.1
    • 3.4.6+dfsg-1ubuntu0.1+esm1
    • 3.4.6+dfsg-1ubuntu0.1+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:Pro:20.04:LTS

    Versions
    • 4.3.4+dfsg-1ubuntu1
    • 4.3.8+dfsg-1ubuntu1
    • 4.3.8+dfsg-1ubuntu1+esm1
    • 4.3.8+dfsg-1ubuntu1+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:Pro:22.04:LTS

    Versions
    • 5.2.6+dfsg-1ubuntu7
    • 5.4.4+dfsg-1ubuntu8
    • 5.4.4+dfsg-1ubuntu8+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:Pro:24.04:LTS

    Versions
    • 5.4.23+dfsg-1ubuntu1
    • 5.4.35+dfsg-3ubuntu1
    • 6.4.5+dfsg-3ubuntu2
    • 6.4.5+dfsg-3ubuntu3
    • 6.4.5+dfsg-3ubuntu3+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:26.10

    Versions
    • 7.4.7+dfsg-1ubuntu1
    • 7.4.9+dfsg-1ubuntu1
    • 7.4.13+dfsg-2ubuntu1
    • 7.4.14+dfsg-1ubuntu2
    • 7.4.15+dfsg-2ubuntu2
    • 7.4.16+dfsg-1ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:26.04:LTS

    Versions
    • 6.4.24+dfsg-1
    • 7.4.5+dfsg-1ubuntu1
    • 7.4.6+dfsg-2ubuntu1
    • 7.4.7+dfsg-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →