Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

影響: composer:symfony/http-foundation >= 6.0.1, < 6.4.46 → 6.4.46, composer:symfony/http-foundation >= 7.0.0, < 7.4.19 → 7.4.19, composer:symfony/http-foundation >= 8.0.0, < 8.1.7 → 8.1.7, composer:symfony/symfony >= 6.0.1, < 6.4.46 → 6.4.46, composer:symfony/symfony >= 7.0.0, < 7.4.19 → 7.4.19, composer:symfony/symfony >= 8.0.0, < 8.1.7 → 8.1.7, composer:symfony/http-foundation >= 4.1.0, < 5.4.54 → 5.4.54, composer:symfony/symfony >= 4.1.0, < 5.4.54 → 5.4.54

HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication. A single req…

Read on GitHub Advisory Database

On 10/28/2026, 04:01 AM, GitHub Advisory Database published "Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header" (type: Advisory). Severity is "High" (high). Related technologies: PHP, Symfony. CVE: CVE-2026-108082.