Read the docs
TI-2026-32915 Aliases CVE-2026-45067GHSA-qpmx-3rfj-7rhv

Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address

Priority LOW 29CWE-93Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

### Description `Symfony\Component\Mime\Address` is the value-object every Symfony Mailer address (to/cc/bcc/from/reply-to) flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary. The constructor accepts email addresses whose local-part (the part before `@`) is an RFC-5322 *quoted string* containing raw `\r\n` bytes — e.g. `"x\r\nBcc: attacker@evil"@example.com`. The stored address is later emitted verbatim into (1) the rendered message headers and (2) `SmtpTransport`'s `MAIL FROM:<...>` / `RCPT TO:<...>` protocol lines, turning the embedded CRLF into a new mail header and/or a new SMTP command. ### Resolution The `Address` constructor now rejects addresses containing line breaks. The patch for this issue is available [here](https://github.com/symfony/symfony/commit/dc2dbd29211eb4ddc451373fa1374fb926e94604) for branch 5.4. ### Credits We would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00598 48th percentileScored 2026-11-07
Fix Fixed symfony (symfony): 5.4.52, 6.4.40, 7.4.12 +1symfony/mime (Packagist): 5.4.52, 6.4.40, 7.4.12 +1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
symfonysymfonybefore 5.4.52; 6.0.0-BETA1 to before 6.4.40; 7.0.0-BETA1 to before 7.4.12; 8.0.0-BETA1 to before 8.0.125.4.52, 6.4.40, 7.4.12, 8.0.12Patch availableCNA
—symfony/mime (Packagist)before 5.4.525.4.52Patch availableGHSA-qpmx-3rfj-7rhv
—symfony/symfony (Packagist)before 5.4.525.4.52Patch availableGHSA-qpmx-3rfj-7rhv
—symfony/mime (Packagist)6.0.0 to before 6.4.406.4.40Patch availableGHSA-qpmx-3rfj-7rhv
—symfony/mime (Packagist)7.0.0 to before 7.4.127.4.12Patch availableGHSA-qpmx-3rfj-7rhv
—symfony/mime (Packagist)8.0.0 to before 8.0.128.0.12Patch availableGHSA-qpmx-3rfj-7rhv
—symfony/symfony (Packagist)6.0.0 to before 6.4.406.4.40Patch availableGHSA-qpmx-3rfj-7rhv
—symfony/symfony (Packagist)7.0.0 to before 7.4.127.4.12Patch availableGHSA-qpmx-3rfj-7rhv
—symfony/symfony (Packagist)8.0.0 to before 8.0.128.0.12Patch availableGHSA-qpmx-3rfj-7rhv
  • symfony Vendorsymfony Affected before 5.4.52; 6.0.0-BETA1 to before 6.4.40; 7.0.0-BETA1 to before 7.4.12; 8.0.0-BETA1 to before 8.0.12 Fixed in 5.4.52, 6.4.40, 7.4.12, 8.0.12 Patch available CNA
  • symfony/mime (Packagist) Vendor— Affected before 5.4.52 Fixed in 5.4.52 Patch available GHSA-qpmx-3rfj-7rhv
  • symfony/symfony (Packagist) Vendor— Affected before 5.4.52 Fixed in 5.4.52 Patch available GHSA-qpmx-3rfj-7rhv
  • symfony/mime (Packagist) Vendor— Affected 6.0.0 to before 6.4.40 Fixed in 6.4.40 Patch available GHSA-qpmx-3rfj-7rhv
  • symfony/mime (Packagist) Vendor— Affected 7.0.0 to before 7.4.12 Fixed in 7.4.12 Patch available GHSA-qpmx-3rfj-7rhv
  • symfony/mime (Packagist) Vendor— Affected 8.0.0 to before 8.0.12 Fixed in 8.0.12 Patch available GHSA-qpmx-3rfj-7rhv
  • symfony/symfony (Packagist) Vendor— Affected 6.0.0 to before 6.4.40 Fixed in 6.4.40 Patch available GHSA-qpmx-3rfj-7rhv
  • symfony/symfony (Packagist) Vendor— Affected 7.0.0 to before 7.4.12 Fixed in 7.4.12 Patch available GHSA-qpmx-3rfj-7rhv
  • symfony/symfony (Packagist) Vendor— Affected 8.0.0 to before 8.0.12 Fixed in 8.0.12 Patch available GHSA-qpmx-3rfj-7rhv

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*——sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* Versions — — ·sensiolabs

Remediation

  • Fix · CNA symfony (symfony) Fixed in 5.4.52, 6.4.40, 7.4.12, 8.0.12
  • Fix · GHSA-qpmx-3rfj-7rhv symfony/mime (Packagist) Fixed in 5.4.52 Advisory →
  • Fix · GHSA-qpmx-3rfj-7rhv symfony/symfony (Packagist) Fixed in 5.4.52 Advisory →
  • Fix · GHSA-qpmx-3rfj-7rhv symfony/mime (Packagist) Fixed in 6.4.40 Advisory →
  • Fix · GHSA-qpmx-3rfj-7rhv symfony/mime (Packagist) Fixed in 7.4.12 Advisory →
  • Fix · GHSA-qpmx-3rfj-7rhv symfony/mime (Packagist) Fixed in 8.0.12 Advisory →
  • Fix · GHSA-qpmx-3rfj-7rhv symfony/symfony (Packagist) Fixed in 6.4.40 Advisory →
  • Fix · GHSA-qpmx-3rfj-7rhv symfony/symfony (Packagist) Fixed in 7.4.12 Advisory →
  • Fix · GHSA-qpmx-3rfj-7rhv symfony/symfony (Packagist) Fixed in 8.0.12 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45067
  2. 2026-10-03 Alias added: GHSA-qpmx-3rfj-7rhv

References

Other 11

  • TI-2024-33775 Ability to change environment from query in symfony/runtime CVSS 3.1HIGH 7.3
  • TI-2026-34283 Twig: The `spaceless` filter implicitly marks its output as safe CVSS 4.0MEDIUM 5.1
  • TI-2022-07667 Code injection in Twig CVSS 3.1CRITICAL 9.8
  • TI-2018-10028 Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key… CVSS 3.0CRITICAL 9.8
  • TI-2026-35851 Incorrect authorization in symfony CVSS 4.0HIGH 8.7
  • TI-2026-35264 Improper input validation in symfony CVSS 4.0HIGH 8.3
See all 94 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences