CVE-2026-108082: SYMFONY REDOS. ONE REQUEST. SECONDS OF CPU

Summary from the TLDR InfoSec newsletter

A crafted Cache-Control header triggers catastrophic regex backtracking in Symfony's HeaderUtils::split(). Symfony parses it on every request, before routing or authentication, and Laravel parses it three times. One request can consume up to 12.7 seconds of CPU, and four merged 8 KB headers can force timeouts. The flaw affects Symfony 4.1 through the October 2026 patches, including Laravel, Drupal, PrestaShop, and Shopware.