- CVE-2026-108082 lets an unauthenticated visitor tie up a PHP server's processor with one crafted header, in a library that Symfony, Laravel and Drupal build on.
- The first patch round broke splitting on a space separator, so only 6.4.48, 7.4.21 and 8.1.9 or later are the complete fix.
- Ask your team which version of symfony/http-foundation each application runs, and whether monitoring would catch high CPU at low traffic.
The risk sits in code nobody chose
Most companies can name the framework their website runs on. Few can name the small library underneath it that reads every incoming request. CVE-2026-108082 is a flaw in exactly that kind of part, and it shows where the risk sits. It is not always in the app your team wrote. It can sit in a shared layer that every request passes through before your own code runs.
The Symfony project published a security advisory (GHSA-r925-mgvr-h9cc) for a regular-expression flaw in its HttpFoundation component. Researcher r3verii reported it. The Symfony advisory says any application that handles HTTP requests can be reached, with no authentication.
How one header costs seconds of CPU
HttpFoundation has a function, HeaderUtils::split(), that breaks a header into its parts. It uses a pattern, a regular expression, to find each part. In the advisory's words, the pattern's token section also matched whitespace. A second check then required that a match must not end on whitespace.
Those two rules fight each other. Given a run of spaces before a separator, the engine can divide the spaces among its repeated steps in exponentially many ways. It tries each way, then rejects each one because it ends on a space. This is called catastrophic backtracking. Think of a clerk asked to check every possible way of splitting a stack of papers into piles, when none of the splits can ever pass.
Symfony's own measurement shows the scale. An 8 KB header containing a run of 17 spaces kept a PHP 8.5 processor busy for 813 milliseconds. Each extra space doubles that time.
Why it is reachable by default
Symfony's request object reads the Cache-Control header by itself each time it is created, and that read goes through the vulnerable function. No special route or setting has to be switched on. The researcher adds that this happens before routing and before authentication. In the researcher's account, even an endpoint that answers 404 or 401 does the work.
Four other headers use the same splitter: Accept, Accept-Language, Cookie and Forwarded. The researcher says they are read only when code asks for them. Cache-Control is read without being asked.
The researcher says the affected library is a base for much more than Symfony. Laravel, Drupal, PrestaShop and Shopware are among those named. The exposure runs from version 4.1, released in 2018, to the patches of October 2026.
Silent failure past 18 spaces
The advisory describes a second effect. From 18 spaces on, PHP's matching call gives up at its backtrack limit. split() then returns an empty array. Every directive in the header is silently dropped, with no error raised.
The lesson here is that a security bug can also be a correctness bug. An application that quietly loses its caching instructions may behave differently, and nothing in the logs says why.
Your framework choice changes the bill
The researcher measured the cost on a real host. One request took 12.7 seconds in the worst case seen. A few requests in parallel are enough to saturate a backend's cores. The researcher also reports that roughly a hundred requests can time out many Laravel web apps.
Laravel pays more than plain Symfony. The researcher says Laravel's Request::capture() builds the request object, rebuilds it, then replaces the headers. The headers are parsed three times as a side effect. Symfony and Drupal parse once. Nobody on a Laravel team chose this.
The researcher also reports that a route using a FormRequest adds further parsing on top of that.
The first patch was not enough
The patch changes the pattern so that spaces are swallowed only when more text follows them. A value can then no longer end on a space, so the engine has nothing to undo. Every repeat in the pattern is also made possessive, meaning matched characters are never given back.
The first round of fixes had a side effect. When the separator itself was a space, splitting the text 'foo bar' returned a single value instead of a split.
If you patched early, check which build you received. The faulty first fix reached Symfony 6.4 as versions 6.4.46 and 6.4.47. It reached 7.4 as 7.4.19 and 7.4.20, and 8.1 as 8.1.7 and 8.1.8. All of those mishandle a space used as a separator.
The complete fix first appears in three releases: 6.4.48 on the 6.4 line, 7.4.21 on 7.4, and 8.1.9 on 8.1. They treat a space acting as a separator as its own case, so the whitespace-swallowing part of the pattern no longer touches it. The advisory also says patches exist for branch 5.4 but gives no version numbers for it.
The sources do not report attacks in the wild. They do describe a payload small enough that any outsider could send it: the researcher puts it at twenty bytes.
What to ask your team this week
Ask whether any application uses symfony/http-foundation, directly or through Laravel, Drupal, PrestaShop or Shopware. Third-party products may bundle it without saying so. Ask which version each one runs. Anything below 6.4.48, 7.4.21 or 8.1.9 on its line needs updating, and that includes the first-round fix releases. Teams on the 5.4 branch should check the advisory for the patched release. Ask whether your edge, such as a firewall or proxy, can cap header length or whitespace runs while you patch.
Ask whether monitoring would notice high CPU at low traffic. By the researcher's account, this attack needs almost no volume. A traffic graph alone would look calm while the servers struggled.
The bug is a small one, and the exposure comes from where it lives. When every request passes through one function, one careless pattern can slow the whole site.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Symfony project (symfony/symfony security advisory GHSA-r925-mgvr-h9cc).
