CVE-2026-108082: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

PKSA-xmwy-rmx5-m7h4 CVE-2026-108082

Affected package: symfony/http-foundation

Affected version: >=5.4.1,<5.4.54|>=6.0.1,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.46|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.19|>=8.0.0,<8.1.0|>=8.1.0,<8.1.7

Reported by:
FriendsOfPHP/security-advisories