CVE-2026-108082: CWE-1333 Inefficient regular expression complexity in sensiolabs symfony

The vulnerability arises from a regular expression in HeaderUtils::split() that parses header values with a pattern whose token alternative matches whitespace followed by a negative lookbehind for whitespace. When a header contains a run of whitespace before a separator, the regex engine explores exponentially many ways to match, causing high CPU usage. This function is called by HeaderBag for the Cache-Control header whenever a Request is built, making the vulnerability reachable by any HTTP request. A crafted header with 17 spaces can cause approximately 813 ms CPU time on PHP 8.5, doubling with each additional space. Beyond 18 spaces, preg_match_all() hits the backtrack limit and split() returns an empty array, silently dropping header directives. Affected Symfony versions include v4.1.0-BETA1 prior to v5.4.54, v6.0.0-BETA1 prior to v6.4.46, v7.0.0-BETA1 prior to v7.4.19, and v8.0.0-BETA1 prior to v8.1.7.

An unauthenticated attacker can send a specially crafted HTTP request with a Cache-Control header containing excessive whitespace to cause high CPU consumption on the server, potentially leading to denial of service. The vulnerability affects all applications using the vulnerable Symfony versions that process HTTP requests. Additionally, when the backtrack limit is reached, header directives are silently dropped, which may affect application behavior.

Fixed versions are available: 5.4.54, 6.4.46, 7.4.19, and 8.1.7. Users should upgrade to these or later versions to remediate the vulnerability. No other mitigation or workaround is indicated in the advisory. Patch status is confirmed by the version boundaries provided.