CVE-2026-108082 in Symfony
Summary
by MITRE • 10/15/2026
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication.
A single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped.
This issue affects symfony/http-foundation v4.1.0-BETA1 prior to v5.4.54, v6.0.0-BETA1 prior to v6.4.46, v7.0.0-BETA1 prior to v7.4.19, and v8.0.0-BETA1 prior to v8.1.7.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in Symfony HTTP Foundation components represents a critical Regular Expression Denial of Service (ReDoS) flaw within the HeaderUtils::split() method. This function is responsible for parsing HTTP header values, specifically invoked during the construction of Request objects to process headers such as Cache-Control. The core technical defect lies in the regular expression pattern used by this utility, which employs a token alternative that matches whitespace followed by a negative lookbehind assertion (?<!\s). When an attacker supplies a maliciously crafted Header value containing a sequence of spaces preceding a separator character, the regex engine encounters catastrophic backtracking. Because the pattern allows for multiple ways to divide runs of whitespace among iterations of enclosing repetitions, the computational complexity grows exponentially with each additional space added to the input string. This behavior forces the PHP interpreter to attempt an exhaustive number of matching permutations before either succeeding or failing, thereby consuming excessive CPU resources and effectively halting application processing capabilities.
The operational impact of this vulnerability is severe due to its remote exploitability without authentication. Since HeaderBag calls split() for every incoming HTTP request that includes specific headers like Cache-Control, any Symfony-based web application handling external traffic is immediately vulnerable. A single crafted request can consume approximately 813 milliseconds of CPU time on PHP 8.5 when processing a run of seventeen spaces within an eight-kilobyte header. The cost doubles for every additional space added to the malicious payload, rapidly escalating into a significant denial-of-service condition that can degrade performance or crash services under load. Furthermore, once the input length exceeds eighteen spaces, the preg_match_all() function hits the pcre.backtrack_limit threshold and fails gracefully by returning an empty array. This failure mode results in all directives within the affected header being silently dropped, potentially leading to unexpected application behavior where security policies or caching instructions are ignored without raising explicit errors, thereby complicating incident response and debugging efforts for system administrators.
From a classification perspective, this vulnerability aligns with CWE-400: Uncontrolled Resource Consumption, as it allows an attacker to exhaust server resources through inefficient algorithmic complexity in input parsing. It also maps directly to the MITRE ATT&CK technique T1496: Resource Hijacking, specifically under the sub-category of Denial of Service via computational exhaustion. The lack of authentication requirements places this flaw in a high-risk category for public-facing applications, as it can be triggered by any unauthenticated actor interacting with the web server. Mitigation strategies must prioritize immediate patching to the specified safe versions: Symfony HTTP Foundation v5.4.54 or later, v6.4.46 or later, v7.4.19 or later, and v8.1.7 or later for users on older branches. In environments where upgrading is not immediately feasible, implementing a Web Application Firewall (WAF) rule to reject HTTP headers containing excessive consecutive whitespace before they reach the application logic can provide effective temporary protection against this specific exploitation vector.