{"id":"ghsa-ghsa-r925-mgvr-h9cc","seq":1708767,"kind":"advisory","title":"Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header","url":"https://github.com/advisories/GHSA-r925-mgvr-h9cc","permalink":"https://vulnpulse.app/items/ghsa-ghsa-r925-mgvr-h9cc","summary":"影響: composer:symfony/http-foundation >= 6.0.1, < 6.4.46 → 6.4.46, composer:symfony/http-foundation >= 7.0.0, < 7.4.19 → 7.4.19, composer:symfony/http-foundation >= 8.0.0, < 8.1.7 → 8.1.7, composer:symfony/symfony >= 6.0.1, < 6.4.46 → 6.4.46, composer:symfony/symfony >= 7.0.0, < 7.4.19 → 7.4.19, composer:symfony/symfony >= 8.0.0, < 8.1.7 → 8.1.7, composer:symfony/http-foundation >= 4.1.0, < 5.4.54 → 5.4.54, composer:symfony/symfony >= 4.1.0, < 5.4.54 → 5.4.54\nHeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication. A single req…","severity":"high","techs":["php","symfony"],"cves":["CVE-2026-108082"],"tags":["GHSA-r925-mgvr-h9cc","symfony/http-foundation","symfony/http-foundation","symfony/http-foundation","symfony/symfony","symfony/symfony","symfony/symfony","symfony/http-foundation","symfony/symfony"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T19:01:39.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}