CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082

The symfony/http-foundation component is vulnerable to a Regular Expression Denial of Service (ReDoS) in the HeaderUtils::split() function. The root cause is a regex pattern that matches whitespace followed by a lookbehind; an attacker can provide a long sequence of whitespace in the Cache-Contro...

EUVD-2026-102102

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082 Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082 Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2025-69581

CVE-2025-69581 An issue was discovered in Chamillo LMS 1.11.2. The Social Network /personaldata endpoint exposes full sensitive user information even after logout because proper cache-control is missing. Using the browser back button restores all personal data, allowing unauthorized users on the...

PT-2026-114951

Name of the Vulnerable Software and Affected Versions symfony/http-foundation versions 4.1.0-BETA1 through 5.4.53 symfony/http-foundation versions 6.0.0-BETA1 through 6.4.45 symfony/http-foundation versions 7.0.0-BETA1 through 7.4.18 symfony/http-foundation versions 8.0.0-BETA1 through 8.1.6...

CLEANSTART-2026-UG48995 undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive

CVE-2026-14643 affects multiple packages. undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. See references for individual vulnerability details...

CLEANSTART-2026-CD82080 undici's cache interceptor mishandles malformed Cache-Control private directives

Security vulnerability affects the langfuse-worker package. undici's cache interceptor mishandles malformed Cache-Control private directives...

undici vulnerable to caching and replay of unsafe HTTP method responses

Impact undici's interceptors.cache documents that it caches only safe HTTP methods. However, its internal skip-list is built by subtracting the configured methods from the safe-methods set, so an unsafe method POST, PUT, PATCH, DELETE never lands in the skip-list and is looked up against the cach...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to undici and nodemailer.

Summary IBM App Connect Enterprise Runtime is vulnerable to multiple vulnerabilities due to undici and nodemailer. Vulnerability Details CVEID:CVE-2026-13697 DESCRIPTION: undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0....

CLEANSTART-2026-ZY12459 undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive

Security vulnerability affects the langfuse package. undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive...

CLEANSTART-2026-QU92900 undici's cache interceptor mishandles malformed Cache-Control private directives

Security vulnerability affects the langfuse package. undici's cache interceptor mishandles malformed Cache-Control private directives...

PT-2026-108511

Security vulnerability affects the langfuse package. undici's cache interceptor mishandles malformed Cache-Control private directives...

Fedora 43 : perl-Catalyst-Plugin-Static-Simple (2026-7c46481544)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7c46481544 advisory. Catalyst::Plugin::Static::Simple for Perl sets the CacheControl header to public for every static asset served. Consequently, intermediaries such as shared...

PT-2026-108601

Security vulnerability affects the langfuse package. undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive...

Linux Distros Unpatched Vulnerability : CVE-2026-76151

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out-of-bounds read buffer over-read in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0...

CVE-2026-15743

A flaw was found in Catalyst::Plugin::Static::Simple for Perl. The servestatic method incorrectly sets the Cache-Control header to "public" for all responses. This misconfiguration allows intermediate proxies to store sensitive content, including responses from authenticated sessions, in shared...

CVE-2026-76151

Out-of-bounds read buffer over-read in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.1, allows remote attackers to cause a denial of service application crash via an excessively large Cache-Control header value...

DEBIAN-CVE-2026-76151

Out-of-bounds read buffer over-read in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.1, allows remote attackers to cause a denial of service application crash via an excessively large Cache-Control header value...