Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication.



A single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped.



This issue affects symfony/http-foundation v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through v6.4.45, v7.0.0-BETA1 through v7.4.18, and v8.0.0-BETA1 through v8.1.6.
Published: 2026-10-15
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch
AI Analysis

Impact

Symfony’s HeaderUtils::split() uses a regular expression that can backtrack exponentially when the Cache‑Control header contains a sequence of spaces before a separator. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, the regex pattern incorrectly matched whitespace, allowing an attacker to craft a header that causes the PHP engine to spend up to a second of CPU per 17 spaces and double that cost with each additional space. This results in a substantial slowdown or complete denial of service for the application. Affected systems

Affected Systems

The vulnerability is present in the Symfony PHP framework, specifically the http‑foundation component from sensiolabs:symfony. All released releases from v4.1.0‑BETA1 through v5.4.53, v6.0.0‑BETA1 through v6.4.45, v7.0.0‑BETA1 through v7.4.18, and v8.0.0‑BETA1 through v8.1.6 are affected. Any web or console application that parses the Cache‑Control request header while using one of these versions can trigger the denial of service. Risk and exploitability

Risk and Exploitability

With a CVSS score of 8.7, this issue is considered high severity. The EPSS score is less than 1 % and it is not listed in the CISA KEV catalog, indicating limited current exploitation. The attack vector is straightforward: an unauthenticated user can send HTTP requests containing a Cache‑Control header with a long series of spaces. Because the vulnerability is triggered during request parsing, any publicly reachable Symfony application that has not applied the patch can be targeted, leading to CPU exhaustion or silently dropped header directives without requiring authentication or special privileges.

Generated by OpenCVE AI on October 16, 2026 at 20:37 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Symfony HTTP foundation component to a version newer than 5.4.54, 6.4.46, 7.4.19, or 8.1.7, which includes the patched regex.
  • If an immediate upgrade is not possible, configure your web server or reverse proxy to reject or limit Cache‑Control headers that contain excessive whitespace or set a hard maximum length for header values to prevent heavy backtracking.
  • Monitor server CPU usage and implement rate limiting or request throttling to detect and mitigate sudden spikes caused by malformed headers, and enable logging and alerting on Cache‑Control header anomalies.

Generated by OpenCVE AI on October 16, 2026 at 20:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-r925-mgvr-h9cc Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header
History

Thu, 15 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Description Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication. A single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped. This issue affects symfony/http-foundation v4.1.0-BETA1 prior to v5.4.54, v6.0.0-BETA1 prior to v6.4.46, v7.0.0-BETA1 prior to v7.4.19, and v8.0.0-BETA1 prior to v8.1.7. Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication. A single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped. This issue affects symfony/http-foundation v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through v6.4.45, v7.0.0-BETA1 through v7.4.18, and v8.0.0-BETA1 through v8.1.6.

Thu, 15 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Description Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication. A single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped. This issue affects symfony/http-foundation v4.1.0-BETA1 prior to v5.4.54, v6.0.0-BETA1 prior to v6.4.46, v7.0.0-BETA1 prior to v7.4.19, and v8.0.0-BETA1 prior to v8.1.7.
Title Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header
First Time appeared Sensiolabs
Sensiolabs symfony
Weaknesses CWE-1333
CPEs cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*
Vendors & Products Sensiolabs
Sensiolabs symfony
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Sensiolabs Symfony
cve-icon MITRE

Status: PUBLISHED

Assigner: Checkmarx

Published:

Updated: 2026-10-15T18:04:45.913Z

Reserved: 2026-10-09T12:09:17.141Z

Link: CVE-2026-108082

cve-icon Vulnrichment

Updated: 2026-10-15T18:04:15.454Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-15T15:17:22.583

Modified: 2026-10-16T16:00:33.533

Link: CVE-2026-108082

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T10:15:06Z

Weaknesses
  • CWE-1333

    Inefficient Regular Expression Complexity