Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-108082— Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

Quick assessment

Affected
sensiolabs symfony
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Symfony 是一个用于 Web 和命令行应用程序的 PHP 框架，以及一组可复用的 PHP 组件。在版本 5.4.54、6.4.46、7.4.19 和 8.1.7 之前， 方法使用一个正则表达式模式来解析头部值，该模式的 token 替代选项会匹配空白字符，随后紧跟一个后行断言 （即前面不能是空白字符）。当前导分隔符之前存在一连串空白字符时，这些空白字符可以在外层重复结构的多次迭代中以指数级多种方式进行划分，而正则表达式引擎会尝试所有可能的划分方式，直到找到匹配结果为止。 每当构建一个 HTTP 请求时， 都会

CVSS 8.7 · High EPSS 0.37% · P29

Affected Version Matrix 4

VendorProduct Version RangeStatus
sensiolabs symfony v4.1.0-BETA1< v5.4.54 affected
v6.0.0-BETA1< v6.4.46 affected
v7.0.0-BETA1< v7.4.19 affected
v8.0.0-BETA1< v8.1.7 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-108082

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header
Source: CVE Program / CVE List V5
Vulnerability Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication. A single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped. This issue affects symfony/http-foundation v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through v6.4.45, v7.0.0-BETA1 through v7.4.18, and v8.0.0-BETA1 through v8.1.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1333
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
sensiolabs symfony v4.1.0-BETA1 ~ v5.4.54 -

II. Public POCs for CVE-2026-108082

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-108082

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-108082 (1)

Vendor Advisories for CVE-2026-108082 (1)

Other References for CVE-2026-108082 (1)

Same Patch Batch · sensiolabs · 2026-10-15 · 3 CVEs total

CVE-2026-109413 8.7 HIGH Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Pro
CVE-2026-109449 8.7 HIGH Symfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the P

IV. Related Vulnerabilities

Same product: symfony
Same vendor: sensiolabs
Same weakness: CWE-1333

V. Comments for CVE-2026-108082

No comments yet

Leave a comment