HighVulnerabilityCVE-2026-108082updated 27 Oct 2026, 19:01 UTC

Symfony web request parsing can be slowed to a crawl by one crafted header

Someone can send a single web request with a specially crafted Cache-Control header that makes the server spend about a second of CPU time on it. Repeating this can slow down or tie up the website.

Fix availableOfficial source

Severity	HighCVSS 8.7 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	Yes5.4.54, 6.4.46 (regression fix in 6.4.48), 7.4.19 (regression fix in 7.4.21), 8.1.7 (regression fix in 8.1.9). Note: 6.4.46-6.4.47, 7.4.19-7.4.20 and 8.1.7-8.1.8 break whitespace-separated splitting, so use 6.4.48, 7.4.21 or 8.1.9 or later. · since 27 Oct 2026
How sure is this?	Official sourceBacked by an official source

How the attack works simplified

1AttackerSends crafted request
2HTTP requestCache-Control header with many spaces
3Symfony RequestHeaderBag calls HeaderUtils::split()
4Regex engineBacktracks exponentially on whitespace
5CPU spikeAbout 1 second per request
ResultServer slowed or denied service

What happened

HeaderUtils::split() in symfony/http-foundation and symfony/symfony uses a regular expression with catastrophic backtracking on whitespace before separators; HeaderBag calls it for Cache-Control on every Request build.

Why it is dangerous: Any application handling HTTP requests is reachable without authentication, so an attacker can cause CPU exhaustion and denial of service. From 18 or more spaces, the Cache-Control directives are silently dropped.

Are you affected?

You are affected if your application uses symfony/http-foundation or symfony/symfony in the vulnerable version ranges listed below.

Package / product	Affected versions	Fixed in
symfony/http-foundation · composer	>= 6.0.1, < 6.4.46	6.4.46
symfony/http-foundation · composer	>= 7.0.0, < 7.4.19	7.4.19
symfony/http-foundation · composer	>= 8.0.0, < 8.1.7	8.1.7
symfony/symfony · composer	>= 6.0.1, < 6.4.46	6.4.46
symfony/symfony · composer	>= 7.0.0, < 7.4.19	7.4.19
symfony/symfony · composer	>= 8.0.0, < 8.1.7	8.1.7
symfony/http-foundation · composer	>= 4.1.0, < 5.4.54	5.4.54
symfony/symfony · composer	>= 4.1.0, < 5.4.54	5.4.54

What to do

Update symfony/http-foundation and symfony/symfony to 5.4.54, 6.4.48, 7.4.21, 8.1.9 or later in your branch
Avoid the first patch releases (6.4.46-6.4.47, 7.4.19-7.4.20, 8.1.7-8.1.8) because they break whitespace-separator splitting
Run composer update and redeploy the application

Timeline

27 Oct 2026, 19:01 UTC
Publicly disclosed
27 Oct 2026, 19:01 UTC
Reported by GitHub Advisory · GitHub Advisory
27 Oct 2026, 19:01 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request HeaderGitHub Advisory · 27 Oct 2026, 19:01 UTC

Technical details

ID: CVE-2026-108082 · GHSA-r925-mgvr-h9cc
CVSS: 8.7 / 10
EPSS: 0.5% chance of exploitation within 30 days
Disclosed: 27 Oct 2026, 19:01 UTC
On Zero Radar: 27 Oct 2026, 19:01 UTC (0 min after disclosure)
Last change: 27 Oct 2026, 19:01 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works