CRLF injection in Symfony - CVE-2026-45067

Detailed vulnerability description

The vulnerability allows a remote attacker to inject arbitrary email headers or SMTP commands.

The vulnerability exists due to improper neutralization of CRLF sequences in Symfony\Component\Mime\Address when processing a quoted-string email address containing raw line breaks. A remote attacker can supply a specially crafted email address to inject arbitrary email headers or SMTP commands.

The issue affects addresses that are later emitted into rendered message headers or SMTP MAIL FROM and RCPT TO protocol lines.

How to mitigate CVE-2026-45067

Sources

• https://github.com/symfony/symfony/security/advisories/GHSA-qpmx-3rfj-7rhv
• https://github.com/symfony/symfony/commit/dc2dbd29211eb4ddc451373fa1374fb926e94604