Symfony HttpFoundation: ReDoS in HeaderUtils::split() via Cache-Control header
Summary
The Symfony HttpFoundation component parses the Cache-Control request header with HeaderUtils::split(). A crafted run of whitespace in this header makes the regular expression backtrack exponentially, so a single unauthenticated request can consume close to a second of CPU. Past a certain number of spaces, the parser gives up and silently drops all Cache-Control directives. The header is parsed while every Request object is built, so any Symfony-based application handling HTTP requests is reachable.
Affected
- symfony/http-foundation v4.1.0-BETA1 to v5.4.53
- symfony/http-foundation v6.0.0-BETA1 to v6.4.45
- symfony/http-foundation v7.0.0-BETA1 to v7.4.18
- symfony/http-foundation v8.0.0-BETA1 to v8.1.6
- Lower bounds differ between sources; check your lockfile against the vendor advisory.
Fixed in
- 5.4.54
- 6.4.48 (6.4.46 and 6.4.47 contain a regression)
- 7.4.21 (7.4.19 and 7.4.20 contain a regression)
- 8.1.9 (8.1.7 and 8.1.8 contain a regression)
Workaround
Unknown. No vendor-published workaround; patching is the stated remedy.
Exploitation
- No reports of active exploitation found; CISA KEV not directly checked.
- A public write-up explains the root cause and impact; no public exploit repository found.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Upgrade symfony/http-foundation to 5.4.54, 6.4.48, 7.4.21 or 8.1.9; do not stop at 6.4.46, 7.4.19 or 8.1.7.
- Run composer audit and check transitive dependencies, for example via Laravel or Drupal.
- If patching is delayed, filter or rate-limit oversized Cache-Control headers at the reverse proxy or WAF, as a temporary measure only.
- Monitor CPU usage and request latency on internet-facing PHP applications.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Symfony advisory blog symfony.com
- GitHub Security Advisory GHSA-r925-mgvr-h9cc github.com
- Symfony PR #66048 (initial fix) github.com
- Symfony PR #66491 (regression fix) github.com
- OSV GHSA-r925-mgvr-h9cc osv.dev
- Ubuntu security notice CVE-2026-108082 ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:31.
Original description (NVD)
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication. A single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped. This issue affects symfony/http-foundation v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through v6.4.45, v7.0.0-BETA1 through v7.4.18, and v8.0.0-BETA1 through v8.1.6.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.