CRLF injection in Symfony - CVE-2026-45070

Detailed vulnerability description

The vulnerability allows a remote attacker to inject arbitrary email headers.

The vulnerability exists due to improper neutralization of CRLF sequences in ParameterizedHeader parameter name handling when serializing structured email headers with user-controlled parameter names. A remote attacker can supply a crafted parameter name containing CRLF characters to inject arbitrary email headers.

The issue affects parameter names in structured headers such as Content-Type and Content-Disposition.

How to mitigate CVE-2026-45070

Sources

• https://github.com/symfony/symfony/security/advisories/GHSA-vqc8-7275-q272
• https://github.com/symfony/symfony/commit/e62ea217f8b4ca8ae922ad0f949e0c4dc1f9b613