ReDoS in Symfony HTTP Foundation via Cache-Control Header

Executive Summary

This is a ReDoS (Regular Expression Denial of Service) vulnerability in Symfony's HttpFoundation component. The issue is in the HeaderUtils::split() function, which incorrectly parsed HTTP headers due to a flawed regex pattern. When processing a Cache-Control header with excessive whitespace, the regex caused exponential backtracking, consuming significant CPU resources and potentially causing denial of service.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unusually high CPU usage during HTTP request processing, particularly when handling Cache-Control headers. Check Symfony versions against affected ranges (4.1.0 to 5.4.53, 6.0.0 to 6.4.45, 7.0.0 to 7.4.18, 8.0.0 to 8.1.6). Use commands like 'curl -H "Cache-Control: [17 spaces]" http://your-server' to test for excessive processing time.

Useful 0 Not Useful 0

Impact Analysis

An attacker could send a single malicious HTTP request with a crafted Cache-Control header containing many spaces. This would consume nearly a second of CPU time per request (813ms for 17 spaces) and double with each additional space. Beyond 18 spaces, the header would be silently dropped. This could degrade server performance or cause temporary unavailability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Symfony to patched versions (5.4.54, 6.4.46, 7.4.19, or 8.1.7). If updating is not possible, implement network-level protections like rate limiting or WAF rules to block malformed headers. Monitor for signs of exploitation such as high CPU load or dropped headers.

Useful 0 Not Useful 0