CVE-2026-108082

published 2026-10-15

CVE-2026-108082: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7…

Priority P3 56 high 8.7 CVSS 4.0

AV N AC L AT N PR N UI N VC N VI N VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication.

A single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped.

This issue affects symfony/http-foundation v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through v6.4.45, v7.0.0-BETA1 through v7.4.18, and v8.0.0-BETA1 through v8.1.6.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
sensiolabs	symfony	>= v4.1.0-BETA1 < v5.4.54	v5.4.54
sensiolabs	symfony	>= v6.0.0-BETA1 < v6.4.46	v6.4.46
sensiolabs	symfony	>= v7.0.0-BETA1 < v7.4.19	v7.4.19
sensiolabs	symfony	>= v8.0.0-BETA1 < v8.1.7	v8.1.7
symfony	http-foundation	>= 4.1.0 < 5.4.54	5.4.54
symfony	http-foundation	>= 6.0.1 < 6.4.46	6.4.46
symfony	http-foundation	>= 7.0.0 < 7.4.19	7.4.19
symfony	http-foundation	>= 8.0.0 < 8.1.7	8.1.7
symfony	symfony	>= 4.1.0 < 5.4.54	5.4.54
symfony	symfony	>= 6.0.1 < 6.4.46	6.4.46
symfony	symfony	>= 7.0.0 < 7.4.19	7.4.19
symfony	symfony	>= 8.0.0 < 8.1.7	8.1.7

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-1333