GHSA-f57v-q966-7fh6
Monolog Header injection in NativeMailerHandler
GHSA-f57v-q966-7fh6 is a vulnerability with no CVSS score yet in monolog/monolog, published May 15, 2024. No source lists public exploit code. Fixed in monolog/monolog 1.12.0.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.12.0monolog/monolog +2 more
Description
A header injection vulnerability has been identified in the NativeMailerHandler of the Monolog library. This vulnerability may allow an attacker to manipulate email headers when log messages are sent via email.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
monolog/monologPackagist | 1.8.0 up to 1.12.0 | 1.12.0 |
monolog/monologTuxCare:Packagist | 1.11.0 up to 1.11.0-p1+tuxcare | 1.11.0-p1+tuxcare |
monolog/monologPackagist | 1.8.0 up to 1.12.0, plus listed versions 1.10.01.11.01.9.01.9.1 | 1.12.0 |
What each source reports
GitHub AdvisoriesNo score
Monolog Header injection in NativeMailerHandler
A header injection vulnerability has been identified in the NativeMailerHandler of the Monolog library. This vulnerability may allow an attacker to manipulate email headers when log messages are sent via email.
- Record
GHSA-f57v-q966-7fh6- Weakness
- CWE-74
- Updated
- 2026-11-02
OSVCLSA-2026-1784077475No score
TuxCare security update for monolog/monolog (1 CVE)
TuxCare rebuilt monolog/monolog to address 1 CVE. Fixed in 1.11.0-p1+tuxcare.
- Record
CLSA-2026-1784077475- Updated
- 2026-11-02
OSVNo score
Monolog Header injection in NativeMailerHandler
A header injection vulnerability has been identified in the NativeMailerHandler of the Monolog library. This vulnerability may allow an attacker to manipulate email headers when log messages are sent via email.
- Record
GHSA-f57v-q966-7fh6- Weakness
- CWE-74
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/Seldaek/monolog/issues/458