Skip to main content

Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVE-2026-45067

High
7.1/10

Summary

`Symfony\Component\Mime\Address` is the value object every Symfony Mailer address (to/cc/bcc/from/reply-to) flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary. The affected versions in 'symfony/mime' and 'symfony/symfony' are prior to 5.4.52, 6.x prior to 6.4.40, 7.x prior to 7.4.12, and 8.x prior to 8.0.12.

CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

The software uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

References

Advisory Timeline

  • Published