https://reddit.com/r/netsec/comments/1x7httc/cve2026108082_symfony_redos_one_request_seconds/: CVE-2026-108082: Symfony ReDoS. One request. Seconds of CPU
Published Oct 16, 2026
·Updated
Affected Software
1 affected component
Symfony Symfony
Applications running Symfony, including Laravel or other software built on Symfony, may be exposed. The post indicates that common configuration can turn the condition into a practical denial of service.
No. The described attack uses a single unauthenticated GET request, so an attacker would only need network access to a reachable affected application.
The post reports that one request can consume seconds of backend CPU. At roughly 100 requests, the application may time out, creating a denial-of-service condition.