CVE-2026-45067
Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
Description
Symfony\Component\Mime\Address is the value-object every Symfony Mailer address (to/cc/bcc/from/reply-to) flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary.
The constructor accepts email addresses whose local-part (the part before @) is an RFC-5322 quoted string containing raw \r\n bytes — e.g. "x\r\nBcc: attacker@evil"@example.com. The stored address is later emitted verbatim into (1) the rendered message headers and (2) SmtpTransport's MAIL FROM:<...> / RCPT TO:<...> protocol lines, turning the embedded CRLF into a new mail header and/or a new SMTP command.
Resolution
The Address constructor now rejects addresses containing line breaks.
The patch for this issue is available here for branch 5.4.
Credits
We would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
Description
Symfony\Component\Mime\Address is the value-object every Symfony Mailer address (to/cc/bcc/from/reply-to) flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary.
The constructor accepts email addresses whose local-part (the part before @) is an RFC-5322 quoted string containing raw \r\n bytes — e.g. "x\r\nBcc: attacker@evil"@example.com. The stored address is later emitted verbatim into (1) the rendered message headers and (2) SmtpTransport's MAIL FROM:<...> / RCPT TO:<...> protocol lines, turning the embedded CRLF into a new mail header and/or a new SMTP command.
Resolution
The Address constructor now rejects addresses containing line breaks.
The patch for this issue is available here for branch 5.4.
Credits
We would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
- Record
CVE-2026-45067- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-93
- Updated
- 2026-11-02
EUVDEUVD-2026-44322
Description
Symfony\Component\Mime\Address is the value-object every Symfony Mailer address (to/cc/bcc/from/reply-to) flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary.
The constructor accepts email addresses whose local-part (the part before @) is an RFC-5322 quoted string containing raw \r\n bytes — e.g. "x\r\nBcc: attacker@evil"@example.com. The stored address is later emitted verbatim into (1) the rendered message headers and (2) SmtpTransport's MAIL FROM:<...> / RCPT TO:<...> protocol lines, turning the embedded CRLF into a new mail header and/or a new SMTP command.
Resolution
The Address constructor now rejects addresses containing line breaks.
The patch for this issue is available here for branch 5.4.
Credits
We would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
- Record
EUVD-2026-44322- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qpmx-3rfj-7rhv
Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
Description
Symfony\Component\Mime\Address is the value-object every Symfony Mailer address (to/cc/bcc/from/reply-to) flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary.
The constructor accepts email addresses whose local-part (the part before @) is an RFC-5322 quoted string containing raw \r\n bytes, e.g. "x\r\nBcc: attacker@evil"@example.com. The stored address is later emitted verbatim into (1) the rendered message headers and (2) SmtpTransport's MAIL FROM:<...> / RCPT TO:<...> protocol lines, turning the embedded CRLF into a new mail header and/or a new SMTP command.
Resolution
The Address constructor now rejects addresses containing line breaks.
The patch for this issue is available here for branch 5.4.
Credits
We would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
- Record
GHSA-qpmx-3rfj-7rhv- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-93
- Updated
- 2026-11-02
NVD
Description
Symfony\Component\Mime\Address is the value-object every Symfony Mailer address (to/cc/bcc/from/reply-to) flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary.
The constructor accepts email addresses whose local-part (the part before @) is an RFC-5322 quoted string containing raw \r\n bytes — e.g. "x\r\nBcc: attacker@evil"@example.com. The stored address is later emitted verbatim into (1) the rendered message headers and (2) SmtpTransport's MAIL FROM:<...> / RCPT TO:<...> protocol lines, turning the embedded CRLF into a new mail header and/or a new SMTP command.
Resolution
The Address constructor now rejects addresses containing line breaks.
The patch for this issue is available here for branch 5.4.
Credits
We would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
- Record
CVE-2026-45067- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-93
- Updated
- 2026-11-02
OSV
Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
Description
Symfony\Component\Mime\Address is the value-object every Symfony Mailer address (to/cc/bcc/from/reply-to) flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary.
The constructor accepts email addresses whose local-part (the part before @) is an RFC-5322 quoted string containing raw \r\n bytes — e.g. "x\r\nBcc: attacker@evil"@example.com. The stored address is later emitted verbatim into (1) the rendered message headers and (2) SmtpTransport's MAIL FROM:<...> / RCPT TO:<...> protocol lines, turning the embedded CRLF into a new mail header and/or a new SMTP command.
Resolution
The Address constructor now rejects addresses containing line breaks.
The patch for this issue is available here for branch 5.4.
Credits
We would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
- Record
CVE-2026-45067- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-93
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-45067
Description Symfony\Component\Mime\Address is the value-object every Symfony Mailer address (to/cc/bcc/from/reply-to) flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary. The constructor accepts email addresses whose local-part (the part before @) is an RFC-5322 quoted string containing raw \r\n bytes — e.g. "x\r\nBcc: attacker@evil"@example.com. The stored address is later emitted verbatim into (1) the rendered message headers and (2) SmtpTransport's MAIL FROM:<...> / RCPT TO:<...> protocol lines, turning the embedded CRLF into a new mail header and/or a new SMTP command. ### Resolution The Address constructor now rejects addresses containing line breaks. The patch for this issue is available here for branch 5.4. ### Credits We would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
- Record
DEBIAN-CVE-2026-45067- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-qpmx-3rfj-7rhv
Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
Description
Symfony\Component\Mime\Address is the value-object every Symfony Mailer address (to/cc/bcc/from/reply-to) flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary.
The constructor accepts email addresses whose local-part (the part before @) is an RFC-5322 quoted string containing raw \r\n bytes, e.g. "x\r\nBcc: attacker@evil"@example.com. The stored address is later emitted verbatim into (1) the rendered message headers and (2) SmtpTransport's MAIL FROM:<...> / RCPT TO:<...> protocol lines, turning the embedded CRLF into a new mail header and/or a new SMTP command.
Resolution
The Address constructor now rejects addresses containing line breaks.
The patch for this issue is available here for branch 5.4.
Credits
We would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
- Record
GHSA-qpmx-3rfj-7rhv- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-93
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-45067
Description Symfony\Component\Mime\Address is the value-object every Symfony Mailer address (to/cc/bcc/from/reply-to) flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary. The constructor accepts email addresses whose local-part (the part before @) is an RFC-5322 quoted string containing raw \r\n bytes — e.g. "x\r\nBcc: attacker@evil"@example.com. The stored address is later emitted verbatim into (1) the rendered message headers and (2) SmtpTransport's MAIL FROM:<...> / RCPT TO:<...> protocol lines, turning the embedded CRLF into a new mail header and/or a new SMTP command. ### Resolution The Address constructor now rejects addresses containing line breaks. The patch for this issue is available here for branch 5.4. ### Credits We would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
- Record
UBUNTU-CVE-2026-45067- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSVCLSA-2026-1782781182 No score
TuxCare security update for symfony/mime (2 CVEs)
TuxCare rebuilt symfony/mime to address 2 CVEs. Fixed in v7.4.9-p1+tuxcare.
- Record
CLSA-2026-1782781182- Updated
- 2026-11-02
OSVCLSA-2026-1782781183 No score
TuxCare security update for symfony/mime (1 CVE)
TuxCare rebuilt symfony/mime to address 1 CVE. Fixed in v6.4.37-p1+tuxcare.
- Record
CLSA-2026-1782781183- Updated
- 2026-11-02
OSVCLSA-2026-1783386120 No score
TuxCare security update for symfony/mime (2 CVEs)
TuxCare rebuilt symfony/mime to address 2 CVEs. Fixed in v5.4.45-p1+tuxcare.
- Record
CLSA-2026-1783386120- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
symfony/mimePackagist |
before 5.4.52 | 5.4.52 |
symfony/symfonyPackagist |
before 5.4.52 | 5.4.52 |
symfony/mimePackagist |
6.0.0 up to 6.4.40 | 6.4.40 |
symfony/mimePackagist |
7.0.0 up to 7.4.12 | 7.4.12 |
symfony/mimePackagist |
8.0.0 up to 8.0.12 | 8.0.12 |
symfony/symfonyPackagist |
6.0.0 up to 6.4.40 | 6.4.40 |
symfony/symfonyPackagist |
7.0.0 up to 7.4.12 | 7.4.12 |
symfony/symfonyPackagist |
8.0.0 up to 8.0.12 | 8.0.12 |
symfony/mimeTuxCare:Packagist From an advisory covering 2 CVEs |
v7.4.9 up to v7.4.9-p1+tuxcare | v7.4.9-p1+tuxcare |
symfony/mimeTuxCare:Packagist |
v6.4.37 up to v6.4.37-p1+tuxcare | v6.4.37-p1+tuxcare |
Show 20 moreShow less
| Package | Affected | Fixed |
|---|---|---|
symfony/mimeTuxCare:Packagist From an advisory covering 2 CVEs |
v5.4.45 up to v5.4.45-p1+tuxcare | v5.4.45-p1+tuxcare |
symfonyDebian:12 |
before 5.4.53+dfsg-0+deb12u1, plus listed versions 5.4.23+dfsg-15.4.23+dfsg-1+deb12u15.4.23+dfsg-1+deb12u25.4.23+dfsg-1+deb12u35.4.23+dfsg-1+deb12u4 Show 17 moreShow less5.4.23+dfsg-1+deb12u55.4.24+dfsg-15.4.25+dfsg-15.4.27+dfsg-15.4.28+dfsg-15.4.29+dfsg-15.4.30+dfsg-15.4.31+dfsg-15.4.31+dfsg-25.4.32+dfsg-15.4.33+dfsg-15.4.34+dfsg-15.4.34+dfsg-25.4.35+dfsg-15.4.35+dfsg-25.4.35+dfsg-35.4.52+dfsg-0+deb12u1 |
5.4.53+dfsg-0+deb12u1 |
symfonyDebian:13 |
before 6.4.41+dfsg-0+deb13u1, plus listed versions 6.4.21+dfsg-26.4.21+dfsg-2+deb13u16.4.24+dfsg-16.4.25+dfsg-16.4.40+dfsg-0+deb13u1 |
6.4.41+dfsg-0+deb13u1 |
symfonyDebian:14 |
before 7.4.12+dfsg-1, plus listed versions 6.4.21+dfsg-26.4.24+dfsg-16.4.25+dfsg-17.0.4+dfsg-17.0.5+dfsg-1 Show 45 moreShow less7.0.6+dfsg-17.0.7+dfsg-17.1.0~beta1+dfsg-17.1.0~rc1+dfsg-17.1.2+dfsg-17.1.3+dfsg-17.1.4+dfsg-17.1.5+dfsg-17.2.0~beta1+dfsg-17.2.0~beta2+dfsg-17.2.0~rc1+dfsg-17.2.1+dfsg-17.2.2+dfsg-17.2.3+dfsg-17.2.4+dfsg-17.2.5+dfsg-17.2.6-17.3.0+dfsg-17.3.0~beta1+dfsg-17.3.0~beta2+dfsg-17.3.0~rc1+dfsg-17.3.1+dfsg-17.3.2+dfsg-17.3.3+dfsg-17.3.4+dfsg-17.3.5-17.4.0+dfsg-17.4.0+dfsg-27.4.0~beta1-17.4.0~beta1-27.4.0~beta2+dfsg-17.4.0~beta2+dfsg-27.4.0~beta2+dfsg-37.4.0~rc1+dfsg-17.4.0~rc2+dfsg-17.4.0~rc3+dfsg-17.4.10+dfsg-17.4.2+dfsg-17.4.2+dfsg-27.4.3+dfsg-17.4.4+dfsg-17.4.5+dfsg-17.4.6+dfsg-17.4.6+dfsg-27.4.7+dfsg-1 |
7.4.12+dfsg-1 |
symfony/mimePackagist |
before 5.4.52, plus listed versions v4.3.0v4.3.0-BETA1v4.3.0-BETA2v4.3.0-RC1v4.3.1 Show 45 moreShow lessv4.3.10v4.3.11v4.3.2v4.3.3v4.3.4v4.3.5v4.3.6v4.3.7v4.3.8v4.3.9v4.4.0v4.4.0-BETA1v4.4.0-BETA2v4.4.0-RC1v4.4.1v4.4.10v4.4.11v4.4.12v4.4.13v4.4.14v4.4.15v4.4.16v4.4.17v4.4.18v4.4.19v4.4.2v4.4.20v4.4.21v4.4.22v4.4.24v4.4.25v4.4.26v4.4.27v4.4.3v4.4.31v4.4.34v4.4.36v4.4.37v4.4.4v4.4.41v4.4.42v4.4.43v4.4.44v4.4.45v4.4.46 |
5.4.52 |
symfony/symfonyPackagist |
before 5.4.52, plus listed versions 2.0.42.0.52.0.62.0.7v2.0.10 Show 45 moreShow lessv2.0.11v2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.17v2.0.18v2.0.19v2.0.20v2.0.21v2.0.22v2.0.23v2.0.24v2.0.25v2.0.9v2.1.0v2.1.0-BETA1v2.1.0-BETA2v2.1.0-BETA3v2.1.0-BETA4v2.1.0-RC1v2.1.0-RC2v2.1.1v2.1.10v2.1.11v2.1.12v2.1.13v2.1.2v2.1.3v2.1.4v2.1.5v2.1.6v2.1.7v2.1.8v2.1.9v2.2.0v2.2.0-BETA1v2.2.0-BETA2v2.2.0-RC1v2.2.0-RC2v2.2.0-RC3v2.2.1v2.2.10v2.2.11 |
5.4.52 |
symfony/mimePackagist |
6.0.0 up to 6.4.40, plus listed versions v6.0.0v6.0.1v6.0.10v6.0.11v6.0.12 Show 45 moreShow lessv6.0.13v6.0.14v6.0.16v6.0.17v6.0.19v6.0.2v6.0.3v6.0.7v6.0.8v6.0.9v6.1.0v6.1.0-BETA1v6.1.0-RC1v6.1.1v6.1.11v6.1.3v6.1.4v6.1.5v6.1.6v6.1.7v6.1.8v6.1.9v6.2.0v6.2.0-BETA1v6.2.0-BETA3v6.2.0-RC1v6.2.0-RC2v6.2.10v6.2.13v6.2.2v6.2.5v6.2.7v6.3.0v6.3.0-BETA1v6.3.0-RC1v6.3.12v6.3.2v6.3.3v6.3.5v6.4.0v6.4.0-BETA1v6.4.0-RC1v6.4.11v6.4.12v6.4.13 |
6.4.40 |
symfony/mimePackagist |
7.0.0 up to 7.4.12, plus listed versions v7.0.0v7.0.3v7.0.6v7.0.7v7.0.8 Show 38 moreShow lessv7.0.9v7.1.0v7.1.0-BETA1v7.1.0-RC1v7.1.1v7.1.10v7.1.11v7.1.2v7.1.4v7.1.5v7.1.6v7.2.0v7.2.0-BETA1v7.2.0-BETA2v7.2.0-RC1v7.2.1v7.2.3v7.2.4v7.2.6v7.2.9v7.3.0v7.3.0-BETA1v7.3.0-RC1v7.3.10v7.3.11v7.3.2v7.3.4v7.3.8v7.4.0v7.4.0-BETA1v7.4.0-RC1v7.4.0-RC2v7.4.4v7.4.5v7.4.6v7.4.7v7.4.8v7.4.9 |
7.4.12 |
symfony/mimePackagist |
8.0.0 up to 8.0.12, plus listed versions v8.0.0v8.0.4v8.0.5v8.0.6v8.0.7v8.0.8v8.0.9 |
8.0.12 |
symfony/symfonyPackagist |
6.0.0 up to 6.4.40, plus listed versions v6.0.0v6.0.1v6.0.10v6.0.11v6.0.12 Show 45 moreShow lessv6.0.13v6.0.14v6.0.15v6.0.16v6.0.17v6.0.18v6.0.19v6.0.2v6.0.20v6.0.3v6.0.4v6.0.5v6.0.6v6.0.7v6.0.8v6.0.9v6.1.0v6.1.0-BETA1v6.1.0-BETA2v6.1.0-RC1v6.1.1v6.1.10v6.1.11v6.1.12v6.1.2v6.1.3v6.1.4v6.1.5v6.1.6v6.1.7v6.1.8v6.1.9v6.2.0v6.2.0-BETA1v6.2.0-BETA2v6.2.0-BETA3v6.2.0-RC1v6.2.0-RC2v6.2.1v6.2.10v6.2.11v6.2.12v6.2.13v6.2.14v6.2.2 |
6.4.40 |
symfony/symfonyPackagist |
7.0.0 up to 7.4.12, plus listed versions v7.0.0v7.0.1v7.0.10v7.0.2v7.0.3 Show 45 moreShow lessv7.0.4v7.0.5v7.0.6v7.0.7v7.0.8v7.0.9v7.1.0v7.1.0-BETA1v7.1.0-RC1v7.1.1v7.1.10v7.1.11v7.1.2v7.1.3v7.1.4v7.1.5v7.1.6v7.1.7v7.1.8v7.1.9v7.2.0v7.2.0-BETA1v7.2.0-BETA2v7.2.0-RC1v7.2.1v7.2.2v7.2.3v7.2.4v7.2.5v7.2.6v7.2.7v7.2.8v7.2.9v7.3.0v7.3.0-BETA1v7.3.0-BETA2v7.3.0-RC1v7.3.1v7.3.10v7.3.11v7.3.2v7.3.3v7.3.4v7.3.5v7.3.6 |
7.4.12 |
symfony/symfonyPackagist |
8.0.0 up to 8.0.12, plus listed versions v8.0.0v8.0.1v8.0.10v8.0.11v8.0.2 Show 7 moreShow lessv8.0.3v8.0.4v8.0.5v8.0.6v8.0.7v8.0.8v8.0.9 |
8.0.12 |
symfonyUbuntu:16.04:LTS |
All versions, plus listed versions 2.7.1+dfsg-12.7.5+dfsg-12.7.9+dfsg-12.7.9+dfsg-1ubuntu22.7.10-0ubuntu2 |
None known |
symfonyUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.8.7+dfsg-1.3ubuntu13.4.3+dfsg-1ubuntu43.4.6+dfsg-13.4.6+dfsg-1ubuntu0.13.4.6+dfsg-1ubuntu0.1+esm13.4.6+dfsg-1ubuntu0.1+esm2 |
None known |
symfonyUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 4.3.4+dfsg-1ubuntu14.3.8+dfsg-1ubuntu14.3.8+dfsg-1ubuntu1+esm14.3.8+dfsg-1ubuntu1+esm2 |
None known |
symfonyUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 5.2.6+dfsg-1ubuntu75.4.4+dfsg-1ubuntu85.4.4+dfsg-1ubuntu8+esm1 |
None known |
symfonyUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 5.4.23+dfsg-1ubuntu15.4.35+dfsg-3ubuntu16.4.5+dfsg-3ubuntu26.4.5+dfsg-3ubuntu36.4.5+dfsg-3ubuntu3+esm1 |
None known |
symfonyUbuntu:25.10 |
All versions, plus listed versions 6.4.18+dfsg-1ubuntu16.4.21+dfsg-26.4.21+dfsg-2ubuntu16.4.24+dfsg-1 |
None known |
symfonyUbuntu:26.10 |
All versions, plus listed versions 7.4.7+dfsg-1ubuntu17.4.9+dfsg-1ubuntu17.4.13+dfsg-2ubuntu17.4.14+dfsg-1ubuntu27.4.15+dfsg-2ubuntu27.4.16+dfsg-1ubuntu2 |
None known |
symfonyUbuntu:26.04:LTS |
All versions, plus listed versions 6.4.24+dfsg-17.4.5+dfsg-1ubuntu17.4.6+dfsg-2ubuntu17.4.7+dfsg-1ubuntu1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | HORKimhab/CVE-2026-45067 | 2026-06-09 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-45067 is a medium vulnerability (CVSS 6.3) in Symfony, published May 27, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 48th percentile. Fixed in symfony/mime 5.4.52.
References
github.com/symfony/symfony/security/advisories/GHSA-qpmx-3rfj-7rhv
Show 12 moreShow less
symfony.com/cve-2026-45067
nvd.nist.gov/vuln/detail/CVE-2026-45067
security-tracker.debian.org/tracker/CVE-2026-45067
ubuntu.com/security/CVE-2026-45067
cve.org/CVERecord?id=CVE-2026-45067
Left out here: 782 versions. The JSON record has them.