CVE-2014-5244: 
PHP vulnerability analysis and mitigation

A denial of service vulnerability was discovered in the Symfony HttpFoundation component affecting all 2.0.X through 2.5.X versions. The vulnerability was disclosed on September 3, 2014 and assigned CVE-2014-5244. When an arbitrarily long hostname is sent by a client, its parsing in Request::getHost() can lead to a DoS attack due to the way hostnames are validated via regular expressions (Symfony Blog).

The vulnerability exists in the hostname validation mechanism of the Request::getHost() method. The issue stems from an inefficient regular expression used to parse and validate hostnames from HTTP requests, which becomes problematic when processing arbitrarily long hostnames. This can cause excessive processing time leading to denial of service (Symfony Blog).

An attacker can exploit this vulnerability by sending HTTP requests with maliciously crafted long Host headers, causing denial of service conditions on affected Symfony applications (Symfony Blog).

The vulnerability can be exploited remotely by sending HTTP requests with specially crafted long Host headers. No special privileges or authentication are required to exploit this issue (GHSA).

The issue has been fixed in Symfony versions 2.3.19, 2.4.9, and 2.5.4. The fix modifies the regular expression used for hostname validation to avoid sensitivity to input length. Users should upgrade to these patched versions. No fixes are provided for versions 2.0, 2.1, and 2.2 as they are no longer maintained (Symfony Blog).

This vulnerability marked the first collaboration between the Drupal Security Team and the Symfony Security Team, as the issue affected both frameworks. The fix was developed with contributions from multiple community members including Chris McCafferty who reported the issue, Nicolas Grekas and Lee Rowlands who provided patches and tests, and Christophe Coevoet and James Gilliland who reviewed the changes (Symfony Blog).