PT-2026-44136 · Symfony · Symfony

Published 2026-05-21 · Updated 2026-05-27 · CVE-2026-45067

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 5.4.21

Description The SymfonyComponentMimeAddress constructor fails to properly validate email addresses when the local-part is a quoted string containing raw carriage return and line feed (r ) bytes. This allows an attacker to embed CRLF sequences, which are later emitted verbatim into rendered message headers and SmtpTransport protocol lines such as MAIL FROM:<...> and RCPT TO:<...>. This behavior can lead to the injection of new mail headers or additional SMTP commands.

Recommendations Update to version 5.4.21 or later.

Exploit

Fix

Weakness Enumeration

CWE-93

Related Identifiers

CVE-2026-45067

GHSA-QPMX-3RFJ-7RHV

Affected Products

Symfony

References · 13

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45067.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/mime/CVE-2026-45067.yaml · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-45067 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-45067 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-45067 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-45067 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-45067 · Security Note
• https://osv.dev/vulnerability/GHSA-qpmx-3rfj-7rhv · Vendor Advisory
• https://github.com/symfony/symfony/security/advisories/GHSA-qpmx-3rfj-7rhv · Note
• https://github.com/symfony/symfony/commit/dc2dbd29211eb4ddc451373fa1374fb926e94604 · Note
• https://github.com/symfony/symfony · Note
• https://symfony.com/blog/cve-2026-45067-email-header-smtp-command-injection-via-crlf-in-symfony-component-mime-address · Note
• https://symfony.com/cve-2026-45067 · Note