Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

影響: composer:symfony/http-foundation >= 6.0.1, < 6.4.46 → 6.4.46, composer:symfony/http-foundation >= 7.0.0, < 7.4.19 → 7.4.19, composer:symfony/http-foundation >= 8.0.0, < 8.1.7 → 8.1.7, composer:symfony/symfony >= 6.0.1, < 6.4.46 → 6.4.46, composer:symfony/symfony >= 7.0.0, < 7.4.19 → 7.4.19, composer:symfony/symfony >= 8.0.0, < 8.1.7 → 8.1.7, composer:symfony/http-foundation >= 4.1.0, < 5.4.54 → 5.4.54, composer:symfony/symfony >= 4.1.0, < 5.4.54 → 5.4.54

HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication. A single req…

GitHub Advisory Databaseで読む

2026/10/28 04:01、GitHub Advisory Databaseが「Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: PHP、Symfony。CVE: CVE-2026-108082。