Symfony HttpFoundation CVE-2026-108082

No special configuration is required: the vulnerable HeaderUtils::split() is invoked automatically by HeaderBag for the Cache-Control header every time a Request object is built, so any Symfony http-foundation deployment (v4.1.0-BETA1 up to the fixed 5.4.54/6.4.46/7.4.19/8.1.7 releases) handling HTTP requests is exploitable by an unauthenticated remote attacker against default configurations. The attacker only needs to control the Cache-Control request header and place a run of whitespace immediately before a separator within a large header value. Limiting factors: per-request CPU cost is bounded by PHP's pcre.backtrack_limit (at 18+ spaces preg_match_all gives up and split returns empty), cost scales with PHP version and header size (~813 ms per request at 17 spaces in an 8 KB header on PHP 8.5), so sustained denial of service requires sending many such requests rather than a single packet.

This is a genuine, easily-reachable denial-of-service issue rather than a high-CVSS-but-low-real-risk item. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the flaw is remotely triggerable with low complexity, no attack requirements, no privileges (PR:N = unauthenticated) and no user interaction, with impact limited to availability (VA:H; VC:N/VI:N). Symfony's own analysis confirms HeaderBag parses the Cache-Control header via HeaderUtils::split() on every Request build, so any HTTP-handling Symfony application is reachable by default with no authentication. The catastrophic-backtracking ReDoS (CWE-1333) is well-documented: a single 8 KB header with 17 spaces costs ~813 ms of CPU on PHP 8.5, doubling per added space, so a modest volume of crafted requests can saturate CPU. Note a self-limiting factor: at 18+ spaces preg_match_all() hits pcre.backtrack_limit and returns empty, capping per-request cost but then silently dropping every Cache-Control directive - a correctness side effect worth flagging. EPSS and KEV status were not provided in the input, so exploitation-probability and active-exploitation signals are unavailable; absence of KEV should not be read as low risk given how trivially the condition is met. No public exploit code was supplied, though the vendor advisory and patch describe the trigger in reproducible detail.

A remote, unauthenticated attacker sends HTTP requests to any Symfony-based application carrying a crafted Cache-Control header containing a run of whitespace before a separator inside a large (~8 KB) header value. HeaderBag automatically invokes HeaderUtils::split() while building the Request, triggering exponential regex backtracking that consumes close to a second of CPU per request (17 spaces on PHP 8.5), and a stream of such requests exhausts server CPU to cause denial of service. No public exploit code was identified in the input, but the vendor advisory describes the trigger precisely enough to reproduce.