Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in v5.4.54, v6.4.46, v7.4.19, v8.1.7, 6.4.46, and 3 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication. A single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped. This issue affects symfony/http-foundation v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through v6.4.45, v7.0.0-BETA1 through v7.4.18, and v8.0.0-BETA1 through v8.1.6.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- symfony/http-foundation
From v4.1.0-BETA1 · fixed in v5.4.54; From v6.0.0-BETA1 · fixed in v6.4.46; From v7.0.0-BETA1 · fixed in v7.4.19; From v8.0.0-BETA1 · fixed in v8.1.7
- symfony/http-foundationPackagist
From 6.0.1 · fixed in 6.4.46
- symfony/http-foundationPackagist
From 7.0.0 · fixed in 7.4.19
- symfony/http-foundationPackagist
From 8.0.0 · fixed in 8.1.7
- symfony/symfonyPackagist
From 6.0.1 · fixed in 6.4.46
- symfony/symfonyPackagist
From 7.0.0 · fixed in 7.4.19
- symfony/symfonyPackagist
From 8.0.0 · fixed in 8.1.7
- symfony/http-foundationPackagist
From 4.1.0 · fixed in 5.4.54
- symfony/symfonyPackagist
From 4.1.0 · fixed in 5.4.54