## Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

- 種別: advisory
- 重大度: high
- 関連技術: php, symfony
- CVE: CVE-2026-108082
- 公開日時: 2026-10-27T19:01:39.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-r925-mgvr-h9cc)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-r925-mgvr-h9cc

影響: composer:symfony/http-foundation >= 6.0.1, < 6.4.46 → 6.4.46, composer:symfony/http-foundation >= 7.0.0, < 7.4.19 → 7.4.19, composer:symfony/http-foundation >= 8.0.0, < 8.1.7 → 8.1.7, composer:symfony/symfony >= 6.0.1, < 6.4.46 → 6.4.46, composer:symfony/symfony >= 7.0.0, < 7.4.19 → 7.4.19, composer:symfony/symfony >= 8.0.0, < 8.1.7 → 8.1.7, composer:symfony/http-foundation >= 4.1.0, < 5.4.54 → 5.4.54, composer:symfony/symfony >= 4.1.0, < 5.4.54 → 5.4.54
HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication. A single req…