ReDoS via the Cache-Control header in Symfony and Laravel

Researcher Martino Spagnuolo demonstrated how a regular expression in symfony/http-foundation can be exploited to exhaust the resources of PHP applications built on Symfony, Laravel, Drupal, and other platforms. The vulnerability, CVE-2026-108082, can be exploited without authentication: an attacker only needs to send an ordinary HTTP request with a specially crafted header. A single request can keep a CPU core busy for several seconds, while multiple concurrent requests can make the application unavailable.

The root cause lies in HeaderUtils::split(), which parses HTTP header values. The regex fragment [^",=]+ allows spaces within a token, while the negative lookbehind (?<!\s) prevents a match from ending with a whitespace character. A string consisting of a followed by 17 spaces and ,x forces the regex engine to explore roughly 2^17 ways of partitioning the spaces before rejecting the match. In one real-world test, a single request took 12.7 seconds to process.

The vulnerability can be triggered through the Cache-Control header, which Symfony parses automatically when constructing the request object, before routing and authentication. This includes requests that ultimately receive 404 or 401 responses. Laravel parses the headers three times during request initialization, increasing the processing overhead. Behind nginx, multiple Cache-Control headers can be merged into a single value without rechecking the combined length. In a laboratory test using Laravel behind nginx, four headers of approximately 8 KB each resulted in a request processing time of nearly nine seconds. A test involving 100 requests with a concurrency level of eight caused increasing response times, timeouts, and 504 errors.

The vulnerability affects symfony/http-foundation from version 4.1 up to the October 2026 security fixes. The recommended fixed releases are 6.4.48, 7.4.21, and 8.1.9, depending on the maintained branch. The initial fixes — 5.4.54, 6.4.46, 7.4.19, and 8.1.7 — addressed the ReDoS issue but introduced regressions in other functionality. The 5.4 branch is no longer supported, and the advisory does not identify a subsequent corrected release for that branch.

As a temporary mitigation, administrators can reject requests with unusually long Cache-Control headers, for example using a WAF rule that limits their length to 50–100 bytes, as suggested by the researcher.

Article: https://r3verii.github.io/cve/2026/10/16/symfony-cache-control-redos.html