Affects the widely used Symfony http-foundation component across many versions; unauthenticated ReDoS and silent header-dropping can disrupt web apps and bypass headers, impacting many organizations.
CVE-2026-108082
ReDoS in Symfony HeaderUtils::split via crafted Cache-Control header causing DoS and header loss
Is CVE-2026-108082 being exploited?
Not confirmed. CVE-2026-108082 does not appear in CISA's Known Exploited Vulnerabilities catalog, which records only exploitation that has been observed and reported publicly. That is evidence of absence of a report, not evidence the flaw is unattacked.
How severe is CVE-2026-108082?
CVE-2026-108082 is rated High with a CVSS score of 8.7. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.
Is there a patch for CVE-2026-108082?
Yes. A fix has been recorded for CVE-2026-108082. The vendor advisory is the authority on the exact fixed version — apply it from there rather than from a summary.
What does CVE-2026-108082 affect?
CVE-2026-108082 affects symfony/http-foundation v4.1.0-BETA1 through v5.4.53, symfony/http-foundation v6.0.0-BETA1 through v6.4.45, symfony/http-foundation v7.0.0-BETA1 through v7.4.18, symfony/http-foundation v8.0.0-BETA1 through v8.1.6, and 1 further product or version. Confirm the exact affected versions against the vendor advisory before deciding you are exposed.
What should I do about CVE-2026-108082?
Upgrade http-foundation to 5.4.54 / 6.4.46 / 7.4.19 / 8.1.7; block malformed Cache-Control headers.
Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.
Unauthenticated ReDoS via Cache-Control header causing high CPU, request slowdown, and silent loss of header directives (may drop auth/cache directives).
Immediate action required
- affected>= v4.1.0-BETA1 and < v5.4.54
- affected>= v6.0.0-BETA1 and < v6.4.46
- affected>= v7.0.0-BETA1 and < v7.4.19
- affected>= v8.0.0-BETA1 and < v8.1.7
As published in the CVE Program record. A version outside these ranges is not a statement that it is unaffected — vendors sometimes understate a range, and distribution-backported builds carry upstream numbers that do not reflect what was patched into them.