Symfony CVE-2026-108082: Whitespace Abuse in HeaderUtils Triggers ReDoS and Silent Cache Directive Loss
Unauthenticated requests with crafted headers can exhaust CPU or silently drop cache directives in vulnerable Symfony web applications.
Key points
- CVE-2026-108082 affects Symfony versions prior to 5.4.54, 6.4.46, 7.4.19, and 8.1.7.
- The flaw allows exponential backtracking in HeaderUtils::split() via whitespace manipulation.
- Requests with sufficient whitespace cause CPU spikes or silent loss of Cache-Control directives.
Symfony applications handling HTTP requests are exposed to a high-severity parsing flaw in the HeaderUtils component. The vulnerability allows attackers to trigger excessive CPU usage or cause silent data loss without authentication.
What happened
The issue stems from how HeaderUtils::split() processes header values in Symfony versions before 5.4.54, 6.4.46, 7.4.19, and 8.1.7. According to the NVD record, the function uses a pattern where a token alternative matches whitespace followed by a negative lookbehind. This structure allows a run of whitespace before a separator to be divided in exponentially many ways during regex iteration. The engine attempts all variations before resolving the match, leading to catastrophic backtracking.
Why it matters
Any application processing HTTP requests is reachable because HeaderBag invokes this function for the Cache-Control header during request building. A single request with a crafted header consumes approximately 813 milliseconds of CPU time on PHP 8.5, doubling with each additional space. From 18 spaces onward, the preg_match_all() function aborts at the pcre.backtrack_limit. Consequently, the split() method returns an empty array, silently dropping every directive in the header. This results in both resource exhaustion and unintended cache behaviour changes.
Next steps
- Inventory applications using Symfony http-foundation components prior to the patched versions.
- Monitor web server logs for unusually long request processing times on endpoints handling headers.
- Review Cache-Control header handling logic to identify potential silent data loss impacts.
- Prepare to update to Symfony 5.4.54, 6.4.46, 7.4.19, or 8.1.7 once available.
Detection notes
Security teams usually detect this activity by monitoring for spikes in CPU utilisation correlated with specific HTTP requests. Check web application firewall logs for repeated attempts to send headers with excessive whitespace characters. Look for anomalies in request duration metrics, particularly where response times increase exponentially with header length. Verify that cache directives are being processed correctly by comparing incoming headers with stored values. Containment often involves rate-limiting requests with unusual header structures or blocking specific malformed patterns at the edge.
What to do and how to stay safe: Symfony
- Audit your infrastructure to identify all instances of Symfony versions affected by CVE-2026-108082.
- Implement monitoring for abnormal CPU consumption on web servers processing unauthenticated requests.
- Review application logs for signs of silent header data loss or unexpected cache behaviour.
- Plan to apply vendor updates once the patched versions are confirmed stable in your environment.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production
General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Symfony versions are affected by this vulnerability?
Versions prior to 5.4.54, 6.4.46, 7.4.19, and 8.1.7 are affected.
What is the CVSS score for CVE-2026-108082?
The National Vulnerability Database rates it as 8.7 HIGH.
Does this flaw require authentication to exploit?
No, any application handling HTTP requests is reachable without authentication.
