Denial of Service Vulnerability in Symfony HTTP Foundation

CVE-2026-108082

What is CVE-2026-108082?

A vulnerability in the HeaderUtils::split() function of the Symfony HTTP Foundation allows attackers to cause a denial of service through specially crafted Cache-Control headers. The poor handling of whitespace characters can lead to excessive CPU consumption, with each crafted header considerably slowing down the parsing process. In extreme cases, the function may become non-responsive, thus compromising the application's ability to process HTTP requests effectively. This affects various releases of the library, making it critical for developers to apply versions v5.4.54, v6.4.46, v7.4.19, or v8.1.7 to mitigate this issue.

References