Detections
Analytics

Symfony and Symfony HTTP Foundation Component 4.1.x < 5.4.54 / 6.0.x < 6.4.46 / 7.0.x < 7.4.19 / 8.0.x < 8.1.7 DoS

high Nessus Plugin ID 373649

Synopsis

A PHP library installed on the remote host is affected by a denial of service vulnerability.

Description

The version of Symfony and/or the Symfony HTTP Foundation Component installed on the remote host is 4.1.0 or later prior to 5.4.54, or 6.0.0 or later prior to 6.4.46, or 7.0.x prior to 7.4.19, or 8.0.x prior to 8.1.7. It is, therefore, affected by a denial of service vulnerability.

 - HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a negative lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable with no authentication. An unauthenticated, remote attacker can exploit this, via a single request carrying such a header, to consume excessive CPU, resulting in a denial of service condition. (CVE-2026-108082)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. Also note that this plugin does not distinguish between PHP packages installed via the OS package manager, PHP packages installed via Composer, or other sources. As a result, packages provided by your OS package repository may have backported fixes that this plugin may incorrectly report as vulnerable. Please refer to the OS-specific plugins for CVE-2026-108082 to check for backported fixes.

Solution

Upgrade Symfony and/or its affected Components to version 5.4.54, 6.4.46, 7.4.19, 8.1.7, or later. Note that the vendor advises 6.4.48, 7.4.21, or 8.1.9 to additionally pick up the fix for a whitespace-separator regression introduced by the initial patch.

See Also

https://github.com/advisories/GHSA-r925-mgvr-h9cc

https://github.com/symfony/symfony/pull/66048

https://github.com/symfony/symfony/pull/66491

https://symfony.com/cve-2026-108082

http://www.nessus.org/u?ad0b1ff1

Plugin Details

Severity: High

ID: 373649

File Name: symfony_http_foundation_GHSA-r925-mgvr-h9cc.nasl

Version: 1.2

Type: Local

Agent: windows, macosx, unix

Family: Misc.

Published: 10/29/2026

Updated: 10/30/2026

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 92.86

CVSS v2

Risk Factor: High

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-108082

CVSS v3

Risk Factor: High

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v4

Risk Factor: High

Base Score: 8.7

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/a:sensiolabs:symfony

Required KB Items: language_library/package/composer/enumerated

Patch Publication Date: 10/15/2026

Vulnerability Publication Date: 10/15/2026

Reference Information

CVE: CVE-2026-108082

CWE: 1333

IAVB: 2026-B-0308