Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication. A single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped. This issue affects symfony/http-foundation v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through v6.4.45, v7.0.0-BETA1 through v7.4.18, and v8.0.0-BETA1 through v8.1.6.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to
    versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose
    token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace placed
    before a separator could be divided among the iterations of the enclosing repetition in exponentially many
    ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header
    whenever a Request is built, so any application handling HTTP requests is reachable, with no
    authentication. A single request carrying such a header costs close to a second of CPU (813 ms for a run
    of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on,
    preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive
    of the header is silently dropped. This issue affects symfony/http-foundation v4.1.0-BETA1 through
    v5.4.53, v6.0.0-BETA1 through v6.4.45, v7.0.0-BETA1 through v7.4.18, and v8.0.0-BETA1 through v8.1.6.
    (CVE-2026-108082)

The version of Symfony and/or the Symfony HTTP Foundation Component installed on the remote host is 4.1.0 or later prior to 5.4.54, or 6.0.0 or later prior to 6.4.46, or 7.0.x prior to 7.4.19, or 8.0.x prior to 8.1.7. It is, therefore, affected by a denial of service vulnerability.

  - HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace,     followed by a negative lookbehind. A run of whitespace placed before a separator could be divided among the     iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before     settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application     handling HTTP requests is reachable with no authentication. An unauthenticated, remote attacker can exploit     this, via a single request carrying such a header, to consume excessive CPU, resulting in a denial of service     condition. (CVE-2026-108082)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. Also note that this plugin does not distinguish between PHP packages installed via the OS package manager, PHP packages installed via Composer, or other sources. As a result, packages provided by your OS package repository may have backported fixes that this plugin may incorrectly report as vulnerable. Please refer to the OS-specific plugins for CVE-2026-108082 to check for backported fixes.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to     versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose     token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace placed     before a separator could be divided among the iterations of the enclosing repetition in exponentially many     ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header     whenever a Request is built, so any application handling HTTP requests is reachable, with no     authentication. A single request carrying such a header costs close to a second of CPU (813 ms for a run     of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on,     preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive     of the header is silently dropped. This issue affects symfony/http-foundation v4.1.0-BETA1 through     v5.4.53, v6.0.0-BETA1 through v6.4.45, v7.0.0-BETA1 through v7.4.18, and v8.0.0-BETA1 through v8.1.6.
    (CVE-2026-108082)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
477759	Chainguard: nextcloud-server-35: security update to 35.0.2-r0	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
477759	Chainguard: nextcloud-server-35: security update to 35.0.2-r0	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
373649	Symfony and Symfony HTTP Foundation Component 4.1.x < 5.4.54 / 6.0.x < 6.4.46 / 7.0.x < 7.4.19 / 8.0.x < 8.1.7 DoS	Nessus	Misc.	Local	high
477588	SCA: security update for symfony/http-foundation, symfony/symfony (GHSA-r925-mgvr-h9cc)	Tenable Cloud Security	SCA Checks	Local	high
477588	SCA: security update for symfony/http-foundation, symfony/symfony (GHSA-r925-mgvr-h9cc)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
366882	Linux Distros Unpatched Vulnerability : CVE-2026-108082	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-108082

high

Tenable Plugins

high

high

high

high

high

high