Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2026-45070

Symfony: Email Header Injection via Non-Token Characters in Mime Parameter Names

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Mime\Header\ParameterizedHeader validates and encodes parameter values but emits parameter names verbatim, allowing a caller that derives a parameter name from untrusted input to include CRLF or other non-token bytes and inject additional headers into rendered structured mail headers such as Content-Type or Content-Disposition. This issue is reported as fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

symfony symfony

  • < 5.4.52affected
  • >= 6.0.0-BETA1, < 6.4.40affected
  • >= 7.0.0-BETA1, < 7.4.12affected
  • >= 8.0.0-BETA1, < 8.0.12affected

symfony mime

  • < 5.4.52affected
  • >= 6.0.0-BETA1, < 6.4.40affected
  • >= 7.0.0-BETA1, < 7.4.12affected
  • >= 8.0.0-BETA1, < 8.0.12affected

References