Refine your search
3 vulnerabilities found for symfony by sensiolabs
CVE-2026-109449 (GCVE-0-2026-109449)
Vulnerability from cvelistv5
Published
2026-10-15 15:19
Modified
2026-10-15 18:05
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-674 - Uncontrolled Recursion
Summary
In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed.
#[Assert\ExpressionSyntax] passes the validated value to ExpressionLanguage::lint(), so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions.
This issue affects symfony/expression-language through v5.4.53, v6.0.0-BETA1 through v6.4.47, v7.0.0-BETA1 through v7.4.20, and v8.0.0-BETA1 through v8.1.8.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| sensiolabs | symfony |
Version: 0 Version: v6.0.0-BETA1 Version: v7.0.0-BETA1 Version: v8.0.0-BETA1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109449",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T18:05:16.968511Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:05:32.422Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/packages/symfony/expression-language",
"defaultStatus": "unaffected",
"modules": [
"ExpressionLanguage::lint()"
],
"packageName": "symfony/expression-language",
"product": "symfony",
"repo": "https://github.com/symfony/expression-language",
"vendor": "sensiolabs",
"versions": [
{
"lessThan": "v5.4.54",
"status": "affected",
"version": "0",
"versionType": "git"
},
{
"lessThan": "v6.4.48",
"status": "affected",
"version": "v6.0.0-BETA1",
"versionType": "git"
},
{
"lessThan": "v7.4.21",
"status": "affected",
"version": "v7.0.0-BETA1",
"versionType": "git"
},
{
"lessThan": "v8.1.9",
"status": "affected",
"version": "v8.0.0-BETA1",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v5.4.54",
"versionStartIncluding": "0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v6.4.48",
"versionStartIncluding": "v6.0.0-beta1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v7.4.21",
"versionStartIncluding": "v7.0.0-beta1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v8.1.9",
"versionStartIncluding": "v8.0.0-beta1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Nicolas Grekas"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In\u0026nbsp;\u003cspan\u003eSymfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9,\u0026nbsp;\u003c/span\u003e\u003cspan\u003ethe parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed.\u003c/span\u003e\u003cdiv\u003e\u003ccode\u003e\u003cbr\u003e\u003c/code\u003e\u003c/div\u003e\u003cdiv\u003e\u003ccode\u003e#[Assert\\ExpressionSyntax]\u003c/code\u003e\u003cspan\u003e passes the validated value to \u003c/span\u003e\u003ccode\u003eExpressionLanguage::lint()\u003c/code\u003e\u003cspan\u003e, so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003eThis issue affects \u003c/span\u003e\u003ccode\u003esymfony/expression-language\u003c/code\u003e\u003cspan\u003e\u0026nbsp;through v5.4.53, v6.0.0-BETA1\u0026nbsp;\u003c/span\u003ethrough\u003cspan\u003e\u0026nbsp;v6.4.47, v7.0.0-BETA1\u0026nbsp;\u003c/span\u003ethrough\u003cspan\u003e\u0026nbsp;v7.4.20, and v8.0.0-BETA1\u0026nbsp;\u003c/span\u003ethrough\u003cspan\u003e\u0026nbsp;v8.1.8.\u003c/span\u003e\u003c/div\u003e"
}
],
"value": "In\u00a0Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9,\u00a0the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed.\n\n\n#[Assert\\ExpressionSyntax] passes the validated value to ExpressionLanguage::lint(), so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions.\n\nThis issue affects symfony/expression-language\u00a0through v5.4.53, v6.0.0-BETA1\u00a0through\u00a0v6.4.47, v7.0.0-BETA1\u00a0through\u00a0v7.4.20, and v8.0.0-BETA1\u00a0through\u00a0v8.1.8."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674 Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:30:42.730Z",
"orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"shortName": "Checkmarx"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/symfony/symfony/security/advisories/GHSA-7rpj-w9pf-39rr"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://symfony.com/blog/cve-2026-109449-unbounded-nesting-in-the-expression-parser-lets-untrusted-expressions-crash-the-process"
},
{
"tags": [
"patch"
],
"url": "https://github.com/symfony/symfony/pull/65690"
},
{
"tags": [
"patch"
],
"url": "https://github.com/symfony/symfony/pull/66720"
},
{
"tags": [
"patch"
],
"url": "https://github.com/symfony/symfony/pull/66723"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Symfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"assignerShortName": "Checkmarx",
"cveId": "CVE-2026-109449",
"datePublished": "2026-10-15T15:19:08.663Z",
"dateReserved": "2026-10-12T16:57:32.590Z",
"dateUpdated": "2026-10-15T18:05:32.422Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109413 (GCVE-0-2026-109413)
Vulnerability from cvelistv5
Published
2026-10-15 14:57
Modified
2026-10-15 18:06
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-674 - Uncontrolled Recursion
Summary
In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A document made of deeply nested inline collections, such as [[[[...]]]], exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error.
Any code parsing untrusted YAML is affected. That includes #[MapRequestPayload] when the Yaml component is installed and the endpoint does not restrict acceptFormat: a single unauthenticated request with a YAML content type is enough.
This issue affects symfony/yaml through v5.4.53, v6.0.0-BETA1 through v6.4.44, v7.0.0-BETA1 through v7.4.17, and v8.0.0-BETA1 through v8.1.5.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| sensiolabs | symfony |
Version: 0 Version: v6.0.0-BETA1 Version: v7.0.0-BETA1 Version: v8.0.0-BETA1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109413",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T18:06:37.552332Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:06:55.183Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/packages/symfony/yaml",
"defaultStatus": "unaffected",
"modules": [
"Symfony\\\\Component\\\\Yaml\\\\Parser::lexInlineStructure()"
],
"packageName": "symfony/yaml",
"product": "symfony",
"repo": "https://github.com/symfony/yaml",
"vendor": "sensiolabs",
"versions": [
{
"lessThan": "v5.4.54",
"status": "affected",
"version": "0",
"versionType": "git"
},
{
"lessThan": "v6.4.45",
"status": "affected",
"version": "v6.0.0-BETA1",
"versionType": "git"
},
{
"lessThan": "v7.4.18",
"status": "affected",
"version": "v7.0.0-BETA1",
"versionType": "git"
},
{
"lessThan": "v8.1.6",
"status": "affected",
"version": "v8.0.0-BETA1",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v5.4.54",
"versionStartIncluding": "0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v6.4.45",
"versionStartIncluding": "v6.0.0-beta1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v7.4.18",
"versionStartIncluding": "v7.0.0-beta1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v8.1.6",
"versionStartIncluding": "v8.0.0-beta1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Nicolas Grekas"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn Symfony YAML prior to versions\u0026nbsp;\u003cspan\u003e5.4.54,\u0026nbsp;\u003c/span\u003e\u003cspan\u003e6.4.45,\u0026nbsp;\u003c/span\u003e\u003cspan\u003e7.4.18, and\u0026nbsp;\u003c/span\u003e\u003cspan\u003e8.1.6,\u0026nbsp;\u003c/span\u003e\u003ccode\u003eYaml\\Parser::lexInlineStructure()\u003c/code\u003e\u003cspan\u003e recursed through \u003c/span\u003e\u003ccode\u003elexInlineMapping()\u003c/code\u003e\u003cspan\u003e and \u003c/span\u003e\u003ccode\u003elexInlineSequence()\u003c/code\u003e\u003cspan\u003e for every \u003c/span\u003e\u003ccode\u003e{\u003c/code\u003e\u003cspan\u003e and \u003c/span\u003e\u003ccode\u003e[\u003c/code\u003e\u003cspan\u003e of an inline collection, without entering the nesting level that the rest of the parser bounds with \u003c/span\u003e\u003ccode\u003emaxNestingLevel\u003c/code\u003e\u003cspan\u003e. A document made of deeply nested inline collections, such as \u003c/span\u003e\u003ccode\u003e[[[[...]]]]\u003c/code\u003e\u003cspan\u003e, exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error.\u003c/span\u003e\u003c/p\u003e\u003cp\u003eAny code parsing untrusted YAML is affected. That includes \u003ccode\u003e#[MapRequestPayload]\u003c/code\u003e when the Yaml component is installed and the endpoint does not restrict \u003ccode\u003eacceptFormat\u003c/code\u003e: a single unauthenticated request with a YAML content type is enough.\u003c/p\u003e\u003cp\u003eThis issue affects \u003ccode\u003esymfony/yaml\u003c/code\u003e\u0026nbsp;through v5.4.53, v6.0.0-BETA1 through\u0026nbsp;v6.4.44, v7.0.0-BETA1 through\u0026nbsp;v7.4.17, and v8.0.0-BETA1 through\u0026nbsp;v8.1.5.\u003c/p\u003e"
}
],
"value": "In Symfony YAML prior to versions\u00a05.4.54,\u00a06.4.45,\u00a07.4.18, and\u00a08.1.6,\u00a0Yaml\\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A document made of deeply nested inline collections, such as [[[[...]]]], exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error.\n\n\n\nAny code parsing untrusted YAML is affected. That includes #[MapRequestPayload] when the Yaml component is installed and the endpoint does not restrict acceptFormat: a single unauthenticated request with a YAML content type is enough.\n\n\n\nThis issue affects symfony/yaml\u00a0through v5.4.53, v6.0.0-BETA1 through\u00a0v6.4.44, v7.0.0-BETA1 through\u00a0v7.4.17, and v8.0.0-BETA1 through\u00a0v8.1.5."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674 Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:29:00.531Z",
"orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"shortName": "Checkmarx"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/symfony/symfony/security/advisories/GHSA-2v3c-qxhr-7vpv"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://symfony.com/blog/cve-2026-109413-unbounded-recursion-in-the-yaml-inline-lexer-lets-a-single-document-crash-the-process"
},
{
"tags": [
"patch"
],
"url": "https://github.com/symfony/symfony/pull/65688"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"assignerShortName": "Checkmarx",
"cveId": "CVE-2026-109413",
"datePublished": "2026-10-15T14:57:00.211Z",
"dateReserved": "2026-10-12T15:28:55.069Z",
"dateUpdated": "2026-10-15T18:06:55.183Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108082 (GCVE-0-2026-108082)
Vulnerability from cvelistv5
Published
2026-10-15 14:46
Modified
2026-10-15 18:04
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-1333 - Inefficient regular expression complexity
Summary
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication.
A single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped.
This issue affects symfony/http-foundation v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through v6.4.45, v7.0.0-BETA1 through v7.4.18, and v8.0.0-BETA1 through v8.1.6.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| sensiolabs | symfony |
Version: v4.1.0-BETA1 Version: v6.0.0-BETA1 Version: v7.0.0-BETA1 Version: v8.0.0-BETA1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108082",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T18:04:09.776300Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:04:45.913Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/packages/symfony/http-foundation",
"defaultStatus": "unaffected",
"modules": [
"Symfony\\Component\\HttpFoundation\\HeaderUtils::split()"
],
"packageName": "symfony/http-foundation",
"product": "symfony",
"repo": "https://github.com/symfony/http-foundation",
"vendor": "sensiolabs",
"versions": [
{
"lessThan": "v5.4.54",
"status": "affected",
"version": "v4.1.0-BETA1",
"versionType": "git"
},
{
"lessThan": "v6.4.46",
"status": "affected",
"version": "v6.0.0-BETA1",
"versionType": "git"
},
{
"lessThan": "v7.4.19",
"status": "affected",
"version": "v7.0.0-BETA1",
"versionType": "git"
},
{
"lessThan": "v8.1.7",
"status": "affected",
"version": "v8.0.0-BETA1",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v5.4.54",
"versionStartIncluding": "v4.1.0-beta1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v6.4.46",
"versionStartIncluding": "v6.0.0-beta1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v7.4.19",
"versionStartIncluding": "v7.0.0-beta1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v8.1.7",
"versionStartIncluding": "v8.0.0-beta1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "r3verii"
},
{
"lang": "en",
"type": "other",
"value": "Duarte Santos"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nicolas Grekas"
}
],
"datePublic": "2026-09-14T11:59:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSymfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions\u0026nbsp;\u003cspan\u003e5.4.54,\u0026nbsp;\u003c/span\u003e\u003cspan\u003e6.4.46,\u0026nbsp;\u003c/span\u003e\u003cspan\u003e7.4.19, and\u0026nbsp;\u003c/span\u003e\u003cspan\u003e8.1.7,\u0026nbsp;\u003c/span\u003e\u003ccode\u003eHeaderUtils::split()\u003c/code\u003e\u003cspan\u003e parsed header values with a pattern whose token alternative also matched whitespace, followed by a \u003c/span\u003e\u003ccode\u003e(?\u0026lt;!\\s)\u003c/code\u003e\u003cspan\u003e lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. \u003c/span\u003e\u003ccode\u003eHeaderBag\u003c/code\u003e\u003cspan\u003e calls it for the \u003c/span\u003e\u003ccode\u003eCache-Control\u003c/code\u003e\u003cspan\u003e header whenever a \u003c/span\u003e\u003ccode\u003eRequest\u003c/code\u003e\u003cspan\u003e is built, so any application handling HTTP requests is reachable, with no authentication.\u003c/span\u003e\u003c/p\u003e\u003cp\u003eA single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, \u003ccode\u003epreg_match_all()\u003c/code\u003e gives up at \u003ccode\u003epcre.backtrack_limit\u003c/code\u003e and \u003ccode\u003esplit()\u003c/code\u003e returns an empty array, so every directive of the header is silently dropped.\u003c/p\u003e\u003cp\u003eThis issue affects \u003ccode\u003esymfony/http-foundation\u003c/code\u003e\u0026nbsp;v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through\u0026nbsp;v6.4.45, v7.0.0-BETA1 through\u0026nbsp;v7.4.18, and v8.0.0-BETA1 through\u0026nbsp;v8.1.6.\u003c/p\u003e"
}
],
"value": "Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions\u00a05.4.54,\u00a06.4.46,\u00a07.4.19, and\u00a08.1.7,\u00a0HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?\u003c!\\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication.\n\n\n\nA single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped.\n\n\n\nThis issue affects symfony/http-foundation\u00a0v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through\u00a0v6.4.45, v7.0.0-BETA1 through\u00a0v7.4.18, and v8.0.0-BETA1 through\u00a0v8.1.6."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "CWE-1333 Inefficient regular expression complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:32:05.788Z",
"orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"shortName": "Checkmarx"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/symfony/symfony/pull/66048"
},
{
"tags": [
"patch"
],
"url": "https://github.com/symfony/symfony/pull/66491"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/symfony/symfony/security/advisories/GHSA-r925-mgvr-h9cc"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://symfony.com/blog/cve-2026-108082-redos-in-headerutils-split-reachable-through-the-cache-control-request-header"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"assignerShortName": "Checkmarx",
"cveId": "CVE-2026-108082",
"datePublished": "2026-10-15T14:46:01.594Z",
"dateReserved": "2026-10-09T12:09:17.141Z",
"dateUpdated": "2026-10-15T18:04:45.913Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}