CVE-2026-108082 Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header
HighCVSS 8.7
EPSS 0.48%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication.
A single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped.
This issue affects symfony/http-foundation v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through v6.4.45, v7.0.0-BETA1 through v7.4.18, and v8.0.0-BETA1 through v8.1.6.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| symfony/http-foundation(Packagist) | >= 6.0.1, < 6.4.46 | 6.4.46 |
| symfony/http-foundation(Packagist) | = v6.0.1 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.0.10 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.0.11 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.0.12 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.0.13 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.0.14 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.0.15 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.0.16 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.0.17 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.0.19 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.0.2 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.0.20 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.0.3 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.0.5 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.0.6 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.0.7 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.0.8 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.0.9 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.1.0 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.1.0-BETA1 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.1.0-BETA2 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.1.0-RC1 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.1.1 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.1.11 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| symfony/http-foundation(Packagist) | = v6.1.12 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.1.2 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.1.3 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.1.4 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.1.5 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.1.6 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.1.7 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.1.8 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.1.9 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.2.0 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.2.0-BETA1 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.2.0-BETA3 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.2.0-RC1 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.2.1 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.2.10 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.2.11 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.2.12 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.2.13 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.2.2 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.2.5 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.2.6 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.2.7 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.2.8 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.3.0 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.3.0-BETA1 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.3.0-BETA3 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.3.0-RC1 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.3.1 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.3.11 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.3.12 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.3.2 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.3.4 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.3.5 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.3.6 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.3.7 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.3.8 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.3.9 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.0 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.0-BETA1 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.0-BETA2 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.0-BETA3 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.0-RC1 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.0-RC2 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.10 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.12 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.13 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.14 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.15 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.16 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.18 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.2 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.21 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.22 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.23 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.24 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.25 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.26 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.28 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.29 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.3 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.30 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.31 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.32 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.33 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.34 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.35 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.4 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.41 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.42 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.43 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.44 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.45 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.7 | No fix listed |
| symfony/http-foundation(Packagist) | = v6.4.8 | No fix listed |
| symfony/http-foundation(Packagist) | >= 7.0.0, < 7.4.19 | 7.4.19 |
| symfony/http-foundation(Packagist) | = v7.0.0 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.0.10 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.0.3 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.0.4 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.0.6 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.0.7 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.0.8 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.1.0 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.1.0-BETA1 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.1.0-RC1 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.1.1 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.1.10 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.1.11 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.1.3 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.1.5 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.1.6 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.1.7 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.1.8 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.1.9 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.2.0 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.2.0-BETA1 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.2.0-BETA2 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.2.0-RC1 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.2.2 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.2.3 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.2.5 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.2.6 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.2.7 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.2.8 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.2.9 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.3.0 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.3.0-BETA1 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.3.0-BETA2 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.3.0-RC1 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.3.1 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.3.10 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.3.11 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.3.2 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.3.3 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.3.4 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.3.5 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.3.6 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.3.7 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.3.8 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.3.9 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.4.0 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.4.0-BETA1 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.4.0-BETA2 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.4.0-RC1 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.4.1 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.4.13 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.4.14 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.4.15 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.4.16 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.4.17 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.4.18 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.4.3 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.4.4 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.4.5 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.4.6 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.4.7 | No fix listed |
| symfony/http-foundation(Packagist) | = v7.4.8 | No fix listed |
| symfony/http-foundation(Packagist) | >= 8.0.0, < 8.1.7 | 8.1.7 |
| symfony/http-foundation(Packagist) | = v8.0.0 | No fix listed |
| symfony/http-foundation(Packagist) | = v8.0.1 | No fix listed |
| symfony/http-foundation(Packagist) | = v8.0.13 | No fix listed |
| symfony/http-foundation(Packagist) | = v8.0.14 | No fix listed |
| symfony/http-foundation(Packagist) | = v8.0.15 | No fix listed |
| symfony/http-foundation(Packagist) | = v8.0.3 | No fix listed |
| symfony/http-foundation(Packagist) | = v8.0.4 | No fix listed |
| symfony/http-foundation(Packagist) | = v8.0.5 | No fix listed |
| symfony/http-foundation(Packagist) | = v8.0.6 | No fix listed |
| symfony/http-foundation(Packagist) | = v8.0.7 | No fix listed |
| symfony/http-foundation(Packagist) | = v8.0.8 | No fix listed |
| symfony/http-foundation(Packagist) | = v8.1.0 | No fix listed |
| symfony/http-foundation(Packagist) | = v8.1.0-BETA1 | No fix listed |
| symfony/http-foundation(Packagist) | = v8.1.0-BETA3 | No fix listed |
| symfony/http-foundation(Packagist) | = v8.1.0-RC1 | No fix listed |
| symfony/http-foundation(Packagist) | = v8.1.1 | No fix listed |
| symfony/http-foundation(Packagist) | = v8.1.2 | No fix listed |
| symfony/http-foundation(Packagist) | = v8.1.4 | No fix listed |
| symfony/http-foundation(Packagist) | = v8.1.5 | No fix listed |
| symfony/http-foundation(Packagist) | = v8.1.6 | No fix listed |
| symfony/symfony(Packagist) | >= 6.0.1, < 6.4.46 | 6.4.46 |
| symfony/symfony(Packagist) | = v6.0.1 | No fix listed |
| symfony/symfony(Packagist) | = v6.0.10 | No fix listed |
| symfony/symfony(Packagist) | = v6.0.11 | No fix listed |
| symfony/symfony(Packagist) | = v6.0.12 | No fix listed |
| symfony/symfony(Packagist) | = v6.0.13 | No fix listed |
| symfony/symfony(Packagist) | = v6.0.14 | No fix listed |
| symfony/symfony(Packagist) | = v6.0.15 | No fix listed |
| symfony/symfony(Packagist) | = v6.0.16 | No fix listed |
| symfony/symfony(Packagist) | = v6.0.17 | No fix listed |
| symfony/symfony(Packagist) | = v6.0.18 | No fix listed |
| symfony/symfony(Packagist) | = v6.0.19 | No fix listed |
| symfony/symfony(Packagist) | = v6.0.2 | No fix listed |
| symfony/symfony(Packagist) | = v6.0.20 | No fix listed |
| symfony/symfony(Packagist) | = v6.0.3 | No fix listed |
| symfony/symfony(Packagist) | = v6.0.4 | No fix listed |
| symfony/symfony(Packagist) | = v6.0.5 | No fix listed |
References
- github.com vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com exploit
- github.com exploit
- github.com product
- github.com
- github.com
- github.com
- github.com
- symfony.com vendor-advisory
- symfony.com
- Red Hat CVE page vendor-advisory
- Red Hat Bugzilla 2553528 issue-tracking
- www.cve.org
- Debian Security Tracker CVE-2026-108082 vendor-advisory
- github.com
- Ubuntu CVE tracker vendor-advisory