Symfony and Symfony HTTP Foundation Component 4.1.x < 5.4.54 / 6.0.x < 6.4.46 / 7.0.x < 7.4.19 / 8.0.x < 8.1.7 DoS

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(373649);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/30");

  script_cve_id("CVE-2026-108082");
  script_xref(name:"IAVB", value:"2026-B-0308");

  script_name(english:"Symfony and Symfony HTTP Foundation Component 4.1.x < 5.4.54 / 6.0.x < 6.4.46 / 7.0.x < 7.4.19 / 8.0.x < 8.1.7 DoS");

  script_set_attribute(attribute:"synopsis", value:
"A PHP library installed on the remote host is affected by a denial of service vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Symfony and/or the Symfony HTTP Foundation Component installed on the remote host is 4.1.0 or later
prior to 5.4.54, or 6.0.0 or later prior to 6.4.46, or 7.0.x prior to 7.4.19, or 8.0.x prior to 8.1.7. It is,
therefore, affected by a denial of service vulnerability.

  - HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace,
    followed by a negative lookbehind. A run of whitespace placed before a separator could be divided among the
    iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before
    settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application
    handling HTTP requests is reachable with no authentication. An unauthenticated, remote attacker can exploit
    this, via a single request carrying such a header, to consume excessive CPU, resulting in a denial of service
    condition. (CVE-2026-108082)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number. Also note that this plugin does not distinguish between PHP packages installed via the OS package manager,
PHP packages installed via Composer, or other sources. As a result, packages provided by your OS package repository may
have backported fixes that this plugin may incorrectly report as vulnerable. Please refer to the OS-specific plugins for
CVE-2026-108082 to check for backported fixes.");
  # https://symfony.com/blog/cve-2026-108082-redos-in-headerutils-split-reachable-through-the-cache-control-request-header
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ad0b1ff1");
  script_set_attribute(attribute:"see_also", value:"https://symfony.com/cve-2026-108082");
  script_set_attribute(attribute:"see_also", value:"https://github.com/advisories/GHSA-r925-mgvr-h9cc");
  script_set_attribute(attribute:"see_also", value:"https://github.com/symfony/symfony/pull/66048");
  script_set_attribute(attribute:"see_also", value:"https://github.com/symfony/symfony/pull/66491");
  script_set_attribute(attribute:"solution", value:
"Upgrade Symfony and/or its affected Components to version 5.4.54, 6.4.46, 7.4.19, 8.1.7, or later. Note that the
vendor advises 6.4.48, 7.4.21, or 8.1.9 to additionally pick up the fix for a whitespace-separator regression
introduced by the initial patch.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-108082");

  script_cwe_id(1333);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/29");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:sensiolabs:symfony");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("php_composer_enum_nix.nbin", "php_composer_enum_win.nbin");
  script_require_keys("language_library/package/composer/enumerated");

  exit(0);
}

include('vcf.inc');
include('vcf_extras_php_packages.inc');

if (!get_one_kb_item('language_library/package/composer/enumerated'))
  exit(0, 'No Composer package enumeration data available.');

var packages = [
  {'component': 'symfony/symfony', 'name': 'Symfony'},
  {'component': 'symfony/http-foundation', 'name': 'Symfony HTTP Foundation Component'}
];

var constraints = [
  {'min_version': '4.1.0', 'fixed_version': '5.4.54'},
  {'min_version': '6.0.0', 'fixed_version': '6.4.46'},
  {'min_version': '7.0.0', 'fixed_version': '7.4.19'},
  {'min_version': '8.0.0', 'fixed_version': '8.1.7'}
];

vcf::php_packages::process_multiple_packages_and_report(
  packages:packages,
  constraints:constraints,
  severity:SECURITY_HOLE
);