Summary
Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header
Description
HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication.
A single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped.
Resolution
The pattern now consumes whitespace only when more of the value follows it, so a value can no longer end on whitespace, nothing has to be given back, and every quantifier is possessive. The first release of this fix broke splitting on a whitespace separator: HeaderUtils::split('foo bar', ' ') returned a single value in 6.4.46 to 6.4.47, 7.4.19 to 7.4.20 and 8.1.7 to 8.1.8. Whitespace characters used as separators are now left out of the whitespace branch, which 6.4.48, 7.4.21 and 8.1.9 contain.
The patches for this issue are available here for branch 5.4 (and forward-ported to 6.4, 7.4, 8.1 and 8.2).
Credits
Symfony would like to thank r3verii for reporting the issue and Nicolas Grekas for providing the fix.
Symfony would also like to thank Bruno Dias from Checkmarx for his help getting a CVE assigned.
Impact
A regular expression with worst-case exponential or polynomial matching time is applied to untrusted input, causing excessive CPU use. Typical impact: denial of service when input is crafted to trigger backtracking.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
symfony/http-foundation to 6.4.46 or later; symfony/http-foundation to 7.4.19 or later; symfony/http-foundation to 8.1.7 or later; symfony/symfony to 6.4.46 or later; symfony/symfony to 7.4.19 or later; symfony/symfony to 8.1.7 or later; symfony/http-foundation to 5.4.54 or later; symfony/symfony to 5.4.54 or later
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-108082? CVE-2026-108082 is a high-severity inefficient regular expression (ReDoS) vulnerability in symfony/http-foundation (composer), affecting versions >= 6.0.1, < 6.4.46. It is fixed in 6.4.46, 7.4.19, 8.1.7, 5.4.54. A regular expression with worst-case exponential or polynomial matching time is applied to untrusted input, causing excessive CPU use.
- Which packages are affected by CVE-2026-108082?
symfony/http-foundation(composer) (versions >= 6.0.1, < 6.4.46)symfony/symfony(composer) (versions >= 6.0.1, < 6.4.46)
- Is there a fix for CVE-2026-108082? Yes. CVE-2026-108082 is fixed in 6.4.46, 7.4.19, 8.1.7, 5.4.54. Upgrade to this version or later.
- Is CVE-2026-108082 exploitable, and should I be worried? Whether CVE-2026-108082 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-108082 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-108082?
- Upgrade
symfony/http-foundationto 6.4.46 or later - Upgrade
symfony/http-foundationto 7.4.19 or later - Upgrade
symfony/http-foundationto 8.1.7 or later - Upgrade
symfony/symfonyto 6.4.46 or later - Upgrade
symfony/symfonyto 7.4.19 or later - Upgrade
symfony/symfonyto 8.1.7 or later - Upgrade
symfony/http-foundationto 5.4.54 or later - Upgrade
symfony/symfonyto 5.4.54 or later
- Upgrade