Symfony Releases Patch for Regex Denial of Service in HeaderUtils
Symfony has released security updates to address a catastrophic backtracking vulnerability in HeaderUtils::split that could allow attackers to trigger a denial of service.
CVE-2026-108082 is a Regular Expression Denial of Service vulnerability in the Symfony framework’s HeaderUtils::split() method.
Triggered by a specifically crafted Cache-Control request header, the bug occurs because the regular expression used to parse header values suffers from catastrophic backtracking. This forces the server to consume excessive CPU resources when processing a manipulated input string, which can slow down or stop the application from responding to legitimate requests.
You should audit your implementation of header parsing, particularly for Cache-Control directives. Because the core issue sits inside the utility class, your actual impact depends on how your application exposes this method to external input.
Fixes are available now. Users need to verify their current version of the framework and apply the security updates provided by the project maintainers. These patches fix the regex inefficiency so input validation no longer leads to resource exhaustion. You can mitigate this service disruption by maintaining updated dependencies.