High 8.7Published Oct 15, 2026

CVE-2026-108082Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

Updated under an hour ago (2026-10-19 06:30 UTC)

Does this affect you?

It affects sensiolabs symfony. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.37%, higher than 29% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for sensiolabs symfony

Exploited in the last 30 days

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication. A single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped. This issue affects symfony/http-foundation v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through v6.4.45, v7.0.0-BETA1 through v7.4.18, and v8.0.0-BETA1 through v8.1.6.

CVSS: 8.7 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness (CWE): CWE-1333
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.37% (percentile 29)
Assigned by: Checkmarx
NVD analysis: Awaiting Analysis
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 15, 2026

Affected products

Affected products

sensiolabs symfony sensiolabs:symfony (from the name)	from v4.1.0-BETA1 before v5.4.54; from v6.0.0-BETA1 before v6.4.46; from v7.0.0-BETA1 before v7.4.19; from v8.0.0-BETA1 before v8.1.7	CNA record

References

https://github.com/symfony/symfony/pull/66048patch
https://github.com/symfony/symfony/pull/66491patch
https://github.com/symfony/symfony/security/advisories/GHSA-r925-mgvr-h9ccvendor-advisory
https://symfony.com/blog/cve-2026-108082-redos-in-headerutils-split-reachable-through-the-cache-control-request-headervendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.