CVE-2026-108082

Name of the Vulnerable Software and Affected Versions symfony/http-foundation versions 4.1.0-BETA1 through 5.4.53 symfony/http-foundation versions 6.0.0-BETA1 through 6.4.45 symfony/http-foundation versions 7.0.0-BETA1 through 7.4.18 symfony/http-foundation versions 8.0.0-BETA1 through 8.1.6

Description The HeaderUtils::split() function parses header values using a pattern where a token alternative matches whitespace followed by a lookbehind. When a sequence of whitespace is placed before a separator, the engine attempts to divide the whitespace among iterations in exponentially many ways. This occurs within HeaderBag when processing the Cache-Control header during Request construction, making any application handling HTTP requests reachable without authentication. A request with a specifically crafted header can cause high CPU consumption; for instance, 17 spaces in an 8 KB header can cost nearly one second of CPU time. When 18 or more spaces are used, preg match all() reaches the pcre.backtrack limit, causing split() to return an empty array and silently drop all header directives.

Recommendations Update symfony/http-foundation to version 5.4.54 or later. Update symfony/http-foundation to version 6.4.46 or later. Update symfony/http-foundation to version 7.4.19 or later. Update symfony/http-foundation to version 8.1.7 or later.