CVE-2026-45067
Gravedad CVSS v4.0:
MEDIA
Tipo:
CWE-93
Neutralización incorrecta de secuencias de retornos de carro y saltos de linea (CRLF)
Fecha de publicación:
14/07/2026
Última modificación:
14/07/2026
Descripción
*** Pendiente de traducción *** ### Description<br />
<br />
`Symfony\Component\Mime\Address` is the value-object every Symfony Mailer address (to/cc/bcc/from/reply-to) flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary.<br />
<br />
The constructor accepts email addresses whose local-part (the part before `@`) is an RFC-5322 *quoted string* containing raw `\r\n` bytes — e.g. `"x\r\nBcc: attacker@evil"@example.com`. The stored address is later emitted verbatim into (1) the rendered message headers and (2) `SmtpTransport`&#39;s `MAIL FROM:` / `RCPT TO:` protocol lines, turning the embedded CRLF into a new mail header and/or a new SMTP command.<br />
<br />
### Resolution<br />
<br />
The `Address` constructor now rejects addresses containing line breaks.<br />
<br />
The patch for this issue is available [here](https://github.com/symfony/symfony/commit/dc2dbd29211eb4ddc451373fa1374fb926e94604) for branch 5.4.<br />
<br />
### Credits<br />
<br />
We would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
Impacto
Puntuación base 4.0
6.30
Gravedad 4.0
MEDIA
Referencias a soluciones, herramientas e información
- https://github.com/symfony/symfony/commit/a1c42cbe517bc146a54da7505a107ded317478fe
- https://github.com/symfony/symfony/releases/tag/v5.4.52
- https://github.com/symfony/symfony/releases/tag/v6.4.40
- https://github.com/symfony/symfony/releases/tag/v7.4.12
- https://github.com/symfony/symfony/releases/tag/v8.0.12
- https://github.com/symfony/symfony/security/advisories/GHSA-qpmx-3rfj-7rhv