CVE-2026-108082: 
PHP 脆弱性の分析と軽減

CVE-2026-108082 is a Regular Expression Denial of Service (ReDoS) vulnerability in Symfony's HTTP Foundation component, specifically in the HeaderUtils::split() method. The flaw is triggered by parsing the Cache-Control request header using a regex pattern that backtracks exponentially when processing specially crafted whitespace before separators. Affected versions span symfony/http-foundation and symfony/symfony packages: >=5.4.1 <5.4.54, >=6.0.1 <6.4.46, >=7.0 <7.4.19, and >=8.0 <8.1.7. The vulnerability was published on October 15, 2026, with a CVSS category estimate of High (GitHub Advisory, Feedly).

The root cause is an inefficient regular expression in HeaderUtils::split() (CWE-1333: Inefficient Regular Expression Complexity) where the token-matching alternative also matched whitespace characters, followed by a possessive or greedy quantifier that causes catastrophic backtracking when the input contains specially crafted sequences of whitespace before separator characters. An unauthenticated remote attacker can exploit this by sending an HTTP request with a malformed Cache-Control header value containing excessive whitespace, causing the server-side regex engine to consume hundreds of milliseconds of CPU per request. Additionally, certain crafted inputs can cause the function to silently return an empty array, effectively dropping all Cache-Control directives (GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to degrade server performance by consuming significant CPU resources (~hundreds of milliseconds per request), which can be amplified into a denial-of-service condition through repeated requests. A secondary impact is the silent discarding of all Cache-Control directives when certain malformed inputs are processed, potentially causing cache-related security controls (e.g., no-store, private) to be silently ignored, which could lead to unintended caching of sensitive responses (GitHub Advisory, Feedly).

The CVE status is currently listed as "Reserved" and no public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the disclosure date. The attack requires no authentication and no special privileges — any attacker capable of sending HTTP requests to a vulnerable Symfony application can trigger the vulnerability. No EPSS score or CISA KEV catalog entry has been identified for this CVE at this time (GitHub Advisory, Feedly).

1. Reconnaissance: Identify web applications built on Symfony (versions >=5.4.1, >=6.0.1, >=7.0, or >=8.0) by inspecting HTTP response headers (e.g., X-Powered-By, error pages, or framework-specific routes).
2. Craft malicious Cache-Control header: Construct an HTTP request with a Cache-Control header containing a specially crafted value with excessive whitespace characters before separator tokens (e.g., commas or semicolons) designed to trigger catastrophic backtracking in the regex engine.
3. Send repeated requests: Flood the target server with these crafted requests using tools like curl, ab (Apache Bench), or custom scripts to amplify CPU exhaustion across multiple threads.
4. Observe impact: Monitor for degraded server response times or errors, indicating successful CPU exhaustion. Optionally, verify the directive-dropping behavior by sending a crafted Cache-Control: no-store header and observing whether the server caches the response (GitHub Advisory).

• Network: High volume of HTTP requests containing abnormally long or whitespace-heavy Cache-Control header values from a single or distributed source IP.
• Logs: Web server or application logs showing repeated requests with unusual Cache-Control header content; elevated request processing times logged by Symfony's profiler or APM tools.
• Process: Sustained high CPU utilization on the PHP-FPM or web server process without a corresponding spike in legitimate traffic; worker processes stuck in regex evaluation.

Symfony has released patched versions addressing this vulnerability: 5.4.54, 6.4.46, 7.4.19, and 8.1.7 for both symfony/http-foundation and symfony/symfony packages. Users should upgrade to the appropriate patched version using Composer (composer update symfony/http-foundation). As a temporary workaround, operators can deploy a Web Application Firewall (WAF) rule to reject or sanitize requests with abnormally long or whitespace-heavy Cache-Control headers before they reach the application (GitHub Advisory, Symfony Blog).

The vulnerability was published by Symfony maintainer fabpot via a GitHub Security Advisory on October 15, 2026, alongside the release of patched versions. Symfony's official blog announced the 5.4.54 release, which includes the fix (Symfony Blog). No significant broader media coverage or notable independent researcher commentary has been identified at this time.