CVE-2026-45067

Summary

Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address

Severity

high

Also known as

GHSA-qpmx-3rfj-7rhv#symfony/mime, GHSA-qpmx-3rfj-7rhv#symfony/symfony

Published

2026-05-27

References

• https://github.com/symfony/symfony/security/advisories/GHSA-qpmx-3rfj-7rhv
• https://github.com/symfony/symfony/commit/dc2dbd29211eb4ddc451373fa1374fb926e94604
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/mime/CVE-2026-45067.yaml

Related advisories

• CVE-2026-45070 — medium · Packagist/symfony/mime

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity