CVE-2026-45067— Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
Quick assessment
Affected
symfony symfony
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Symfony是Symfony组织开源的一个用于 Web 和控制台应用程序的 PHP 框架以及一组可重用的 PHP 组件。 Symfony存在输入验证错误漏洞，该漏洞源于Address构造函数接受包含换行符的RFC-5322引号字符串，导致CRLF注入问题，攻击者可借此嵌入新的邮件标头或SMTP命令。以下版本受到影响：5.4.52之前版本、6.4.40之前版本、7.4.12之前版本和8.0.12之前版本。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-45067
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
Source: CVE Program / CVE List V5
Vulnerability Description
### Description
`Symfony\Component\Mime\Address` is the value-object every Symfony Mailer address (to/cc/bcc/from/reply-to) flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary.
The constructor accepts email addresses whose local-part (the part before `@`) is an RFC-5322 *quoted string* containing raw `\r\n` bytes — e.g. `"x\r\nBcc: attacker@evil"@example.com`. The stored address is later emitted verbatim into (1) the rendered message headers and (2) `SmtpTransport`'s `MAIL FROM:<...>` / `RCPT TO:<...>` protocol lines, turning the embedded CRLF into a new mail header and/or a new SMTP command.
### Resolution
The `Address` constructor now rejects addresses containing line breaks.
The patch for this issue is available [here](https://github.com/symfony/symfony/commit/dc2dbd29211eb4ddc451373fa1374fb926e94604) for branch 5.4.
### Credits
We would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对CRLF序列的转义处理不恰当(CRLF注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Symfony 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Symfony是Symfony组织开源的一个用于 Web 和控制台应用程序的 PHP 框架以及一组可重用的 PHP 组件。 Symfony存在输入验证错误漏洞，该漏洞源于Address构造函数接受包含换行符的RFC-5322引号字符串，导致CRLF注入问题，攻击者可借此嵌入新的邮件标头或SMTP命令。以下版本受到影响：5.4.52之前版本、6.4.40之前版本、7.4.12之前版本和8.0.12之前版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-45067
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-45067
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-45067 (3)
Vendor Advisories for CVE-2026-45067 (1)
Vendor Pages for CVE-2026-45067 (1)
Other References for CVE-2026-45067 (1)
Same Patch Batch · symfony · 2026-07-14 · 30 CVEs total
| CVE-2026-45070 | Symfony: Email Header Injection via Non-Token Characters in Mime Parameter Names | |
| CVE-2026-46644 | symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only | |
| CVE-2026-48761 | Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, | |
| CVE-2026-48736 | Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-c | |
| CVE-2026-48747 | Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signatu | |
| CVE-2026-48760 | Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks an | |
| CVE-2026-48489 | Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access t | |
| CVE-2026-48784 | Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Gener | |
| CVE-2026-47212 | Symfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauth | |
| CVE-2026-45068 | Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address | |
| CVE-2026-45071 | Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = | |
| CVE-2026-47767 | Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/AP | |
| CVE-2026-45075 | Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureVali | |
| CVE-2026-45304 | Symfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansio | |
| CVE-2026-45063 | Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator | |
| CVE-2026-45756 | Symfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Wi | |
| CVE-2026-45133 | Symfony: [Yaml] Harden the parser when handling untrusted input | |
| CVE-2026-45754 | Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthentica | |
| CVE-2026-45069 | Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims | |
| CVE-2026-45753 | Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascr |
Showing top 20 of 30 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: symfony
-
CVE-2026-50157
Auth0 Symfony: Bearer Token Accepted via URL Query Parameter -
CVE-2026-48761
Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attr -
CVE-2026-48747
Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algor -
CVE-2026-48489
Symfony: Security Firewall Bypass via failure_forward Subreq -
CVE-2026-48760
Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive:
Same vendor: symfony
-
CVE-2026-49215
Symfony UX: CSRF Protection Bypass in symfony/ux-live-compon -
CVE-2026-49216
Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJA -
CVE-2026-49211
Symfony UX: Information exposure via unescaped LIKE wildcard -
CVE-2026-49208
Symfony UX: Format-less date LiveProps parsed with the permi -
CVE-2026-49210
Symfony UX: XSS in symfony/ux-live-component via attacker-co
Same weakness: CWE-93
-
CVE-2026-102136
Kiteworks Core Command Execution through Configuration Injec -
CVE-2026-102145
Kiteworks Core Server-Side Request Forgery through CRLF Inje -
CVE-2026-102938
virtualenv writes prompt values into pyvenv.cfg without sani -
CVE-2026-82973
Improper Neutralization of CRLF Sequences ('CRLF Injection') -
CVE-2026-100717
froxlor before 2.3.12 CRLF Injection via validateUrl userinf
V. Comments for CVE-2026-45067
No comments yet