Key points
- CVE-2026-108082 is rated High severity with a CVSS score of 8.7
- Affected versions include Symfony 5.4 before 5.4.54, 6.4 before 6.4.46, 7.4 before 7.4.19, and 8.1 before 8.1.7
- The flaw allows attackers to exhaust CPU cycles or silently drop Cache-Control header directives
Symfony applications handling HTTP requests are exposed to a denial-of-service vector through flawed header parsing. The vulnerability allows unauthenticated users to trigger excessive CPU usage or cause the application to silently discard cache instructions.
What happened
The National Vulnerability Database records CVE-2026-108082 as a high-severity flaw in the Symfony PHP framework. The issue resides in the HeaderUtils::split() method, which processes header values using a regular expression pattern. According to the advisory, this pattern incorrectly matches whitespace followed by a lookbehind assertion that excludes whitespace. This logic error causes the regex engine to attempt an exponential number of iterations when it encounters a run of whitespace before a separator.
The HeaderBag component invokes this method for the Cache-Control header whenever a new Request object is constructed. Consequently, any Symfony application that processes incoming HTTP requests is reachable by this vector. No authentication is required to send the malicious headers. The weakness is classified under CWE-1333, relating to incorrect usage of regular expressions.
Why it matters
A single malicious request can consume approximately one second of CPU time. Testing on PHP 8.5 showed that an 8 KB header containing 17 spaces took 813 milliseconds to process. The processing time doubles with each additional space character included in the header value. This exponential growth makes the flaw highly effective for resource exhaustion attacks against web servers running affected Symfony versions.
When the header contains 18 or more spaces, the preg_match_all() function exceeds the pcre.backtrack_limit configuration setting. At this point, the function aborts and the split() method returns an empty array. This results in the silent dropping of every directive within the Cache-Control header. Applications relying on these directives for caching behaviour will operate incorrectly without any visible error messages.
What happens next
The vulnerability affects symfony/http-foundation versions starting from v4.1.0-BETA1 up to v5.4.53. It also impacts versions from v6.0.0-BETA1 up to v6.4.45, v7.0.0-BETA1 up to v7.4.18, and v8.0.0-BETA1 up to v8.1.6. Organizations must identify all instances of these specific version ranges within their infrastructure.
Patch priority
Teams should immediately inventory all servers running Symfony to determine exposure levels. Systems exposed to the public internet require urgent attention due to the unauthenticated nature of the attack. Prioritise updates for high-traffic endpoints where CPU exhaustion would cause significant service disruption. Roll out fixes in a controlled manner, starting with staging environments to verify application stability. Ensure that backup procedures are in place before applying framework updates to production systems. Monitor server logs for unusual CPU spikes that may indicate ongoing exploitation attempts while remediation is underway.
What to do and how to stay safe: Symfony
- Verify the specific version of symfony/http-foundation installed on all servers to confirm if it falls within the affected ranges
- Monitor server CPU utilisation metrics for sudden spikes that could indicate active exploitation of the regex backtracking flaw
- Implement rate limiting at the network edge or web application firewall to restrict the volume of requests from single sources
- Once the vendor provides an update, apply the patch to affected systems and restart services to ensure the new code is loaded
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific Symfony versions are affected by CVE-2026-108082?
Versions prior to 5.4.54, 6.4.46, 7.4.19, and 8.1.7 are affected, including beta releases from v4.1.0-BETA1 onwards.
Is authentication required to exploit this vulnerability?
No, the source material states that any application handling HTTP requests is reachable with no authentication required.
What happens if the header contains more than 17 spaces?
With 18 or more spaces, the function aborts and returns an empty array, causing Cache-Control directives to be silently dropped.
