
HttpFoundation Cache-Control: what I would change after CVE-2026-108082
CVE-2026-108082 is a ReDoS in HeaderUtils::split() on Cache-Control. composer audit can pass on 7.4.19 while split('foo bar', ' ') still returns one part. I would bump to 7.4.21 / 6.4.48 / 8.1.9, or 5.4.54. This is not a Laravel-core CVE.
Oct 23, 2026 · 6 min read