Inefficient regular expression complexity in Symfony - CVE-2026-108082

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient regular expression complexity in Symfony's HeaderUtils::split() when parsing Cache-Control request headers. A remote attacker can send a request containing a run of whitespace before a separator in the header value to cause a denial of service.

If regular expression processing reaches pcre.backtrack_limit, the function returns an empty array and silently drops all directives in the header.

Affected software

How to mitigate CVE-2026-108082

External References

• https://github.com/symfony/symfony/security/advisories/GHSA-r925-mgvr-h9cc
• https://github.com/symfony/symfony/commit/343a1772ce6ac03e48b228d2d7168d19750e3f36

Related Security Bulletins

• Inefficient regular expression complexity in Symfony