MediumGHSA-vqc8-7275-q272CVE-2026-45070

Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names

Published 27 May 2026 · Updated 10 Sept 2026

Affected packages

symfony/mimeComposer
Affected
<5.4.52
Fixed in
5.4.52
Update to the fixed version for your release line, for example:composer require symfony/mime:^5.4.52
symfony/symfonyComposer
Affected
<5.4.52
Fixed in
5.4.52
Update to the fixed version for your release line, for example:composer require symfony/symfony:^5.4.52
symfony/mimeComposer
Affected
>=6.0.0 <6.4.40
Fixed in
6.4.40
Update to the fixed version for your release line, for example:composer require symfony/mime:^6.4.40
symfony/mimeComposer
Affected
>=7.0.0 <7.4.12
Fixed in
7.4.12
Update to the fixed version for your release line, for example:composer require symfony/mime:^7.4.12
symfony/mimeComposer
Affected
>=8.0.0 <8.0.12
Fixed in
8.0.12
Update to the fixed version for your release line, for example:composer require symfony/mime:^8.0.12
symfony/symfonyComposer
Affected
>=6.0.0 <6.4.40
Fixed in
6.4.40
Update to the fixed version for your release line, for example:composer require symfony/symfony:^6.4.40
symfony/symfonyComposer
Affected
>=7.0.0 <7.4.12
Fixed in
7.4.12
Update to the fixed version for your release line, for example:composer require symfony/symfony:^7.4.12
symfony/symfonyComposer
Affected
>=8.0.0 <8.0.12
Fixed in
8.0.12
Update to the fixed version for your release line, for example:composer require symfony/symfony:^8.0.12

Details

Description

Symfony\Component\Mime\Header\ParameterizedHeader (and the related parameter handling reachable from Symfony\Component\Mime\Header\Headers) is responsible for serializing structured headers such as Content-Type and Content-Disposition, which carry key=value parameters (e.g. Content-Disposition: attachment; filename="x").

RFC 2045 / RFC 5322 require parameter *names* to be tokens: a restricted ASCII subset that excludes whitespace, CR/LF, and the tspecials set. Symfony's parameter handling validates and properly encodes parameter *values*, but does not validate parameter *names*: the supplied name is emitted verbatim into the serialized header.

A caller that derives a parameter name from untrusted input, e.g. an application that lets a user influence a Content-Disposition parameter name, can include \r\n or other non-token bytes inside the name, terminating the current header and injecting additional headers in the rendered message. This is the classic CRLF / header-injection primitive applied to the parameter-name slot.

Resolution

ParameterizedHeader now rejects parameter names that contain bytes outside the RFC token character class.

The patch for this issue is available here for branch 5.4.

Credits

Symfony would like to thank Fabian Fleischer for reporting the issue and Alexandre Daubois for fixing it.

Is GHSA-vqc8-7275-q272 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected symfony/mime, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.