CVE-2026-118514

In Symfony http-foundation prior to versions 5.4.56, 6.4.50, 7.4.23, and 8.1.11, Symfony\Component\HttpFoundation\RequestMatcher, and RequestMatcher\MethodRequestMatcher which replaces it from 6.2.x on, matches a request against a list of HTTP methods. These compared the request method to the lis...

EUVD-2026-118267

In Symfony http-foundation prior to versions 5.4.56, 6.4.50, 7.4.23, and 8.1.11, Symfony\Component\HttpFoundation\RequestMatcher, and RequestMatcher\MethodRequestMatcher which replaces it from 6.2.x on, matches a request against a list of HTTP methods. These compared the request method to the lis...

CVE-2026-118514: symfony: In Symfony http-foundation prior to versions 5.4.56, 6.4.50, 7.4.23, and 8.1.11,…

In Symfony http-foundation prior to versions 5.4.56, 6.4.50, 7.4.23, and 8.1.11, Symfony\Component\HttpFoundation\RequestMatcher, and RequestMatcher\MethodRequestMatcher which replaces it from 6.2.x on, matches a request against a list of HTTP methods. These compared the request method to the lis...

CVE-2026-108082

A flaw was found in symfony/http-foundation. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request containing headers with repetitive whitespace. Inefficient regular expression processing on these header values causes excessive CPU resource...

Symfony and Symfony HTTP Foundation Component 4.1.x < 5.4.54 / 6.0.x < 6.4.46 / 7.0.x < 7.4.19 / 8.0.x < 8.1.7 DoS

The version of Symfony and/or the Symfony HTTP Foundation Component installed on the remote host is 4.1.0 or later prior to 5.4.54, or 6.0.0 or later prior to 6.4.46, or 7.0.x prior to 7.4.19, or 8.0.x prior to 8.1.7. It is, therefore, affected by a denial of service vulnerability. -...

EUVD-2026-102102

Symfony: ReDoS in HeaderUtils::split Reachable Through the Cache-Control Request Header...

CLSA-2026-1792567918 TuxCare security update for symfony/http-foundation (1 CVE)

TuxCare rebuilt symfony/http-foundation to address 1 CVE. Fixed in v6.4.35-p1+tuxcare...

CLSA-2026-1792567795 TuxCare security update for symfony/http-foundation (1 CVE)

TuxCare rebuilt symfony/http-foundation to address 1 CVE. Fixed in v7.4.8-p1+tuxcare...

CLSA-2026-1792567291 TuxCare security update for symfony/http-foundation (1 CVE)

TuxCare rebuilt symfony/http-foundation to address 1 CVE. Fixed in v5.4.50-p1+tuxcare...

PT-2026-134493

TuxCare rebuilt symfony/http-foundation to address 1 CVE. Fixed in v7.4.8-p1+tuxcare...

PT-2026-134494

TuxCare rebuilt symfony/http-foundation to address 1 CVE. Fixed in v6.4.35-p1+tuxcare...

PT-2026-134492

TuxCare rebuilt symfony/http-foundation to address 1 CVE. Fixed in v5.4.50-p1+tuxcare...

CLSA-2026-1792529052 TuxCare security update for symfony/http-foundation (1 CVE)

TuxCare rebuilt symfony/http-foundation to address 1 CVE. Fixed in 4.4.49-p3+tuxcare...

PT-2026-134315

TuxCare rebuilt symfony/http-foundation to address 1 CVE. Fixed in 4.4.49-p3+tuxcare...

Linux Distros Unpatched Vulnerability : CVE-2026-108082

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7,...

UBUNTU-CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

Regular Expression Denial of Service (ReDoS)

Overview symfony/http-foundation is a component defines an object-oriented layer for the HTTP specification. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via HeaderUtils::split in HeaderUtils.php, which uses a regular expression containing an...

DEBIAN-CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...