Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header
High · fetched 2026-10-27
### Description `HeaderUtils::split()` parsed header values with a pattern whose token alternative also matched whitespace, followed by a `(?<!\s)` lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. `HeaderBag` calls it for the `Cache-Control` header whenever a `Request` is built, so any application handling HTTP requests is reachable, with no authentication.
Remediation
Upgrade symfony/http-foundation to 6.4.46 or later. Upgrade symfony/http-foundation to 7.4.19 or later. Upgrade symfony/http-foundation to 8.1.7 or later.
Affected PHP branches
See the source advisory.
Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-27T16:20:12-04:00 · https://github.com/advisories/GHSA-r925-mgvr-h9cc