Regular expression denial of service in Symfony HeaderUtils::split()
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1333.
Summary
Symfony versions from v4.1.0-BETA1 before v5.4.54, from v6.0.0-BETA1 before v6.4.46, from v7.0.0-BETA1 before v7.4.19, and from v8.0.0-BETA1 before v8.1.7 are affected. A regular expression in HeaderUtils::split() backtracks exponentially on runs of whitespace (CWE-1333). An unauthenticated remote attacker can send one HTTP request with a crafted Cache-Control header to consume close to a second of CPU.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication. A single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped. This issue affects symfony/http-foundation v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through v6.4.45, v7.0.0-BETA1 through v7.4.18, and v8.0.0-BETA1 through v8.1.6.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | symfony/http-foundation (Packagist) | 6.0.1 to before 6.4.46 | 6.4.46 | Patch available | GHSA-r925-mgvr-h9cc |
| — | symfony/http-foundation (Packagist) | 7.0.0 to before 7.4.19 | 7.4.19 | Patch available | GHSA-r925-mgvr-h9cc |
| — | symfony/http-foundation (Packagist) | 8.0.0 to before 8.1.7 | 8.1.7 | Patch available | GHSA-r925-mgvr-h9cc |
| — | symfony/symfony (Packagist) | 6.0.1 to before 6.4.46 | 6.4.46 | Patch available | GHSA-r925-mgvr-h9cc |
| — | symfony/symfony (Packagist) | 7.0.0 to before 7.4.19 | 7.4.19 | Patch available | GHSA-r925-mgvr-h9cc |
| — | symfony/symfony (Packagist) | 8.0.0 to before 8.1.7 | 8.1.7 | Patch available | GHSA-r925-mgvr-h9cc |
| — | symfony/http-foundation (Packagist) | 4.1.0 to before 5.4.54 | 5.4.54 | Patch available | GHSA-r925-mgvr-h9cc |
| — | symfony/symfony (Packagist) | 4.1.0 to before 5.4.54 | 5.4.54 | Patch available | GHSA-r925-mgvr-h9cc |
- symfony/http-foundation (Packagist) Vendor— Affected 6.0.1 to before 6.4.46 Fixed in 6.4.46 Patch available GHSA-r925-mgvr-h9cc
- symfony/http-foundation (Packagist) Vendor— Affected 7.0.0 to before 7.4.19 Fixed in 7.4.19 Patch available GHSA-r925-mgvr-h9cc
- symfony/http-foundation (Packagist) Vendor— Affected 8.0.0 to before 8.1.7 Fixed in 8.1.7 Patch available GHSA-r925-mgvr-h9cc
- symfony/symfony (Packagist) Vendor— Affected 6.0.1 to before 6.4.46 Fixed in 6.4.46 Patch available GHSA-r925-mgvr-h9cc
- symfony/symfony (Packagist) Vendor— Affected 7.0.0 to before 7.4.19 Fixed in 7.4.19 Patch available GHSA-r925-mgvr-h9cc
- symfony/symfony (Packagist) Vendor— Affected 8.0.0 to before 8.1.7 Fixed in 8.1.7 Patch available GHSA-r925-mgvr-h9cc
- symfony/http-foundation (Packagist) Vendor— Affected 4.1.0 to before 5.4.54 Fixed in 5.4.54 Patch available GHSA-r925-mgvr-h9cc
- symfony/symfony (Packagist) Vendor— Affected 4.1.0 to before 5.4.54 Fixed in 5.4.54 Patch available GHSA-r925-mgvr-h9cc
Remediation
Upgrade symfony/symfony to v5.4.54, v6.4.46, v7.4.19, or v8.1.7, and symfony/http-foundation to 5.4.54, 6.4.46, 7.4.19, or 8.1.7, matching the branch in use.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · GHSA-r925-mgvr-h9cc symfony/http-foundation (Packagist) Fixed in 6.4.46 Advisory →
- Fix · GHSA-r925-mgvr-h9cc symfony/http-foundation (Packagist) Fixed in 7.4.19 Advisory →
- Fix · GHSA-r925-mgvr-h9cc symfony/http-foundation (Packagist) Fixed in 8.1.7 Advisory →
- Fix · GHSA-r925-mgvr-h9cc symfony/symfony (Packagist) Fixed in 6.4.46 Advisory →
- Fix · GHSA-r925-mgvr-h9cc symfony/symfony (Packagist) Fixed in 7.4.19 Advisory →
- Fix · GHSA-r925-mgvr-h9cc symfony/symfony (Packagist) Fixed in 8.1.7 Advisory →
- Fix · GHSA-r925-mgvr-h9cc symfony/http-foundation (Packagist) Fixed in 5.4.54 Advisory →
- Fix · GHSA-r925-mgvr-h9cc symfony/symfony (Packagist) Fixed in 5.4.54 Advisory →
Vendor assessments
Timeline
- 2026-10-16 Threatist record created from CVE-2026-108082
- 2026-10-27 Alias added: GHSA-r925-mgvr-h9cc
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
Advisory 3
Other 10
- https://github.com/symfony/symfony/commit/343a1772ce6ac03e48b228d2d7168d19750e3f36
- https://github.com/symfony/symfony/commit/9ffa802e5d7e9fb8ba95eeefd27e863e83b1baca
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2026-108082.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-108082.yaml
- https://github.com/symfony/symfony
- https://github.com/symfony/symfony/releases/tag/v5.4.54
- https://github.com/symfony/symfony/releases/tag/v6.4.48
- https://github.com/symfony/symfony/releases/tag/v7.4.21
- https://github.com/symfony/symfony/releases/tag/v8.1.9
- https://symfony.com/cve-2026-108082
More sensiolabs vulnerabilities
- TI-2019-13616 An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0… CVSS 3.1CRITICAL 9.8
- TI-2018-10604 An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through… CVSS 3.1MEDIUM 6.5
- TI-2019-08131 In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and… CVSS 3.1CRITICAL 9.8
- TI-2016-02159 Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass… CVSS 3.0CRITICAL 9.8
- TI-2019-08459 An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. CVSS 3.1CRITICAL 9.8
- TI-2018-08136 An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2026-108082 · CVE Program
- CVE-2026-108082 · NVD
- FIRST EPSS
- GHSA-r925-mgvr-h9cc · GitHub Advisory Database · CC BY 4.0
- CVE-2026-108082 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences