Symfony and Symfony HTTP Foundation Component 4.1.x < 5.4.54 / 6.0.x < 6.4.46 / 7.0.x < 7.4.19 / 8.0.x < 8.1.7 DoS

The version of Symfony and/or the Symfony HTTP Foundation Component installed on the remote host is 4.1.0 or later prior to 5.4.54, or 6.0.0 or later prior to 6.4.46, or 7.0.x prior to 7.4.19, or 8.0.x prior to 8.1.7. It is, therefore, affected by a denial of service vulnerability. -...

EUVD-2026-102102

Symfony: ReDoS in HeaderUtils::split Reachable Through the Cache-Control Request Header...

CLSA-2026-1792567918 TuxCare security update for symfony/http-foundation (1 CVE)

TuxCare rebuilt symfony/http-foundation to address 1 CVE. Fixed in v6.4.35-p1+tuxcare...

CLSA-2026-1792567795 TuxCare security update for symfony/http-foundation (1 CVE)

TuxCare rebuilt symfony/http-foundation to address 1 CVE. Fixed in v7.4.8-p1+tuxcare...

CLSA-2026-1792567291 TuxCare security update for symfony/http-foundation (1 CVE)

TuxCare rebuilt symfony/http-foundation to address 1 CVE. Fixed in v5.4.50-p1+tuxcare...

CLSA-2026-1792529052 TuxCare security update for symfony/http-foundation (1 CVE)

TuxCare rebuilt symfony/http-foundation to address 1 CVE. Fixed in 4.4.49-p3+tuxcare...

Linux Distros Unpatched Vulnerability : CVE-2026-108082

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7,...

UBUNTU-CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

Regular Expression Denial of Service (ReDoS)

Overview symfony/http-foundation is a component defines an object-oriented layer for the HTTP specification. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via HeaderUtils::split in HeaderUtils.php, which uses a regular expression containing an...

Astra Linux – Vulnerability in symfony

Symfony/http-foundation is a module for the Symphony PHP framework that defines an object-oriented layer for handling HTTP requests. The Request class does not parse URIs containing special characters in the same way that browsers do. As a result, attackers can trick validators that rely on the...

DEBIAN-CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082 Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082

The symfony/http-foundation component is vulnerable to a Regular Expression Denial of Service (ReDoS) in the HeaderUtils::split() function. The root cause is a regex pattern that matches whitespace followed by a lookbehind; an attacker can provide a long sequence of whitespace in the Cache-Contro...

CVE-2026-108082 Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082 Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

PT-2026-114951

Name of the Vulnerable Software and Affected Versions symfony/http-foundation versions 4.1.0-BETA1 through 5.4.53 symfony/http-foundation versions 6.0.0-BETA1 through 6.4.45 symfony/http-foundation versions 7.0.0-BETA1 through 7.4.18 symfony/http-foundation versions 8.0.0-BETA1 through 8.1.6...