CVE-2026-108082 with a CVSS score of 8.7 is a regular expression denial of service vulnerability in Symfony HTTP Foundation HeaderUtils::split(), reachable through the Cache-Control request header. The affected notation is symfony/http-foundation (composer) versions >= 6.0.1, < 6.4.46; symfony/http-foundation (composer) versions >= 7.0.0, < 7.4.19; symfony/http-foundation (composer) versions >= 8.0.0, < 8.1.7; symfony/symfony (composer) versions >= 6.0.1, < 6.4.46; symfony/symfony (composer) versions >= 7.0.0, < 7.4.19; symfony/symfony (composer) versions >= 8.0.0, < 8.1.7; symfony/http-foundation (composer) versions >= 4.1.0, < 5.4.54; and symfony/symfony (composer) versions >= 4.1.0, < 5.4.54. The flaw occurs because the parsing pattern allows whitespace to be consumed in multiple ways before a separator, causing exponential backtracking when a crafted header contains a long run of whitespace. An unauthenticated remote attacker can send a single HTTP request with such a Cache-Control header, causing the server to spend substantial CPU time, close to a second for a modest crafted header, and increasing sharply with additional whitespace. This can degrade service responsiveness, consume processing capacity, and potentially cause denial of service for applications that build requests from incoming headers. The header directives may also be silently dropped when the regex engine gives up, affecting cache-control handling and application behavior.
We recommend you to update symfony/http-foundation to version 5.4.54, 6.4.48, 7.4.21, or 8.1.9.[/subscribe_to_unlock_form]
CVE-2026-108082 with a CVSS score of 8.7 is a regular expression denial of service vulnerability in Symfony HTTP Foundation HeaderUtils::split(), reachable through the Cache-Control request header. The affected notation is symfony/http-foundation (composer) versions >= 6.0.1, < 6.4.46; symfony/http-foundation (composer) versions >= 7.0.0, < 7.4.19; symfony/http-foundation (composer) versions >= 8.0.0, < 8.1.7; symfony/symfony (composer) versions >= 6.0.1, < 6.4.46; symfony/symfony (composer) versions >= 7.0.0, < 7.4.19; symfony/symfony (composer) versions >= 8.0.0, < 8.1.7; symfony/http-foundation (composer) versions >= 4.1.0, < 5.4.54; and symfony/symfony (composer) versions >= 4.1.0, < 5.4.54. The flaw occurs because the parsing pattern allows whitespace to be consumed in multiple ways before a separator, causing exponential backtracking when a crafted header contains a long run of whitespace. An unauthenticated remote attacker can send a single HTTP request with such a Cache-Control header, causing the server to spend substantial CPU time, close to a second for a modest crafted header, and increasing sharply with additional whitespace. This can degrade service responsiveness, consume processing capacity, and potentially cause denial of service for applications that build requests from incoming headers. The header directives may also be silently dropped when the regex engine gives up, affecting cache-control handling and application behavior.
We recommend you to update symfony/http-foundation to version 5.4.54, 6.4.48, 7.4.21, or 8.1.9.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]