UBUNTU-CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ext4: Avoid cycles in the h-tree A maliciously corrupted filesystem can contain cycles in the h-tree stored inside a directory. This can easily lead to the kernel corrupting tree nodes that have already been verified during...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ext4: Fixed a slab-use-after-free in ext4splitextentat. We encountered the following use-after-free issues: BUG: KASAN: slab-use-after-free in ext4splitextentat+0xba8/0xcc0 Read of size 2 at addr ffff88810548ed08 by task...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: perf/core: Prevents VMA splitting of buffer mappings. The perfmmap code is careful to map the user page using mmap along with the ringbuffer and the auxiliary buffer, when the event supports this. Once the first mapping is...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fixed the memory leak related to ‘conf-biosplit’. In the error path of raid10run, ‘conf’ needs to be freed. However, ‘conf-biosplit’ is not freed, resulting in a memory leak. Since there are three places where ‘conf’...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: x86/EFI: The deferral of freeing boot services memory The efifreebootservices function frees the memory occupied by EFIBOOTSERVICESCODE and EFIBOOTSERVICESDATA using memblockfreelate. There are two issues with this approach:...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Wifi: iwlwifi – Fix the order of debug actions. The order in which debug actions were performed was incorrectly implemented. Now, we have implemented the dump split mechanism and perform the FW reset only at the middle of the dum...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: VMCI: Fixed a runtime warning from memcpy in dgdispatchashost. Syzkaller encountered a “WARNING in dgdispatchashost” bug. memcpy: A field-spanning write was detected size 56 for a single field “&dginfo-msg” in...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: Un-sharing of page tables occurs during VMA splitting, not before. Currently, splitvma triggers the un-sharing of hugetlb page tables through vmops-maysplit. This occurs before the VMA lock and rmap locks are taken –...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwc-qos: Disable split header for Tegra194 There is a long-standing issue with the Synopsys DWC Ethernet driver for Tegra194, where random system crashes have been observed 0. The problem occurs when the split header...

Astra Linux – Vulnerability in grub2

Out-of-bounds write when handling split HTTP headers: When dealing with split HTTP headers, GRUB2’s HTTP code accidentally moves its internal data buffer point by one position. This can lead to an out-of-bounds write during the parsing of the HTTP request, resulting in writing a NULL byte beyond...

CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082

The symfony/http-foundation component is vulnerable to a Regular Expression Denial of Service (ReDoS) in the HeaderUtils::split() function. The root cause is a regex pattern that matches whitespace followed by a lookbehind; an attacker can provide a long sequence of whitespace in the Cache-Contro...

EUVD-2026-102102

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082 Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082 Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

PT-2026-114951

Name of the Vulnerable Software and Affected Versions symfony/http-foundation versions 4.1.0-BETA1 through 5.4.53 symfony/http-foundation versions 6.0.0-BETA1 through 6.4.45 symfony/http-foundation versions 7.0.0-BETA1 through 7.4.18 symfony/http-foundation versions 8.0.0-BETA1 through 8.1.6...

CVE-2026-108082: Inefficient Regular Expression Complexity

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-86566

A flaw exists in DPDK lib/vhost where a guest providing runt RX descriptors can trigger an integer underflow (CWE-191) in the copy length during vhost enqueue (supporting both split and packed rings). This vulnerability results in a denial of service for shared vhost backends, such as OVS-DPDK . ...