CVE-2026-45070

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45070
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45070.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45070
Aliases
Downstream
Related
Published
2026-07-14T18:25:46.647Z
Modified
2026-07-18T03:41:55.473316596Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Symfony: Email Header Injection via Non-Token Characters in Mime Parameter Names
Details

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Mime\Header\ParameterizedHeader validates and encodes parameter values but emits parameter names verbatim, allowing a caller that derives a parameter name from untrusted input to include CRLF or other non-token bytes and inject additional headers into rendered structured mail headers such as Content-Type or Content-Disposition. This issue is reported as fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Database specific 
{
    "cwe_ids": [
        "CWE-93"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45070.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/symfony/security-http

Affected ranges

Type
GIT
Repo
https://github.com/symfony/security-http
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
355f32f4318c962842f016eabd0966fde739f6fc
Introduced
6530589fc40cdceda230fb6a69173ce52fa8b5ca
Fixed
816860d96c4fb7ffd7708ae0531ea6e5a1190773
Introduced
f84d7d3c93e6a884908402775199b1f7d55c7be1
Fixed
1fc7ca636cbd2cad29b42cc13c9fd0c681c6efee
Introduced
bea6dc79db4d95c34b77ec27273d812aa64d65be
Fixed
d776945b2dc41c0e609c56c1ef69863ab56856ed
Database specific 
{
    "cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.4.52"
        },
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.4.40"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.4.12"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.0.12"
        }
    ],
    "source": "CPE_RANGE"
}
Type
GIT
Repo
https://github.com/symfony/symfony
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
eabc5f9ed7831fe6de8d609c5ebc29aed1f8ef8f
Introduced
aa4e97099b5a67bdc9f2387fe8d099f5c712f81c
Fixed
95a951788e30c45356278f4e4472cbbf552d0eb9
Introduced
d78c5f403d7ee794993660b1d5155536edd36fc1
Fixed
275f5cbccbcc50205206f05e599c4f57009aadb8
Introduced
2e913a829cfbbf9cb38b321bdff1806b44b192eb
Fixed
06d3b2c9a8aeb5d8493738cc51e24f6a1215827c
Fixed
e62ea217f8b4ca8ae922ad0f949e0c4dc1f9b613
Database specific 
{
    "cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.4.52"
        },
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.4.40"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.4.12"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.0.12"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v2.*
v2.0.0
v2.0.0-RC1
v2.0.0-RC2
v2.0.0-RC3
v2.0.0-RC4
v2.0.0-RC5
v2.0.0-RC6
v2.0.0BETA1
v2.0.0BETA2
v2.0.0BETA3
v2.0.0BETA4
v2.0.0BETA5
v2.0.0PR8
v2.1.0
v2.1.0-BETA1
v2.1.0-BETA2
v2.1.0-BETA3
v2.1.0-BETA4
v2.1.0-RC1
v2.1.0-RC2
v2.2.0-BETA1
v2.2.0-BETA2
v2.3.0-BETA1
v2.3.0-BETA2
v2.4.0-BETA1
v2.4.0-BETA2
v2.4.0-RC1
v2.5.0
v2.5.0-BETA1
v2.5.0-BETA2
v2.5.0-RC1
v2.5.1
v2.5.2
v2.6.0-BETA1
v3.*
v3.0.0
v3.0.0-BETA1
v3.1.0
v3.1.0-BETA1
v3.1.0-RC1
v3.1.1
v3.2.0-BETA1
v3.2.0-RC1
v3.3.0-BETA1
v3.3.0-RC1
v4.*
v4.0.0-BETA1
v4.0.0-BETA2
v4.0.0-BETA3
v4.0.0-BETA4
v4.0.0-RC1
v4.1.0-BETA1
v4.2.0
v4.2.0-BETA1
v4.2.0-BETA2
v4.2.0-RC1
v4.3.0-BETA1
v4.3.0-BETA2
v5.*
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.1.0-BETA1
v5.1.0-RC1
v5.2.0
v5.2.0-BETA1
v5.2.0-BETA2
v5.2.0-BETA3
v5.2.0-RC1
v5.2.0-RC2
v5.3.0-BETA1
v5.3.0-BETA2
v5.3.0-BETA3
v5.3.0-BETA4
v5.3.0-RC1
v5.4.0
v5.4.0-BETA1
v5.4.0-BETA2
v5.4.0-BETA3
v5.4.0-RC1
v5.4.1
v5.4.10
v5.4.11
v5.4.12
v5.4.13
v5.4.14
v5.4.15
v5.4.16
v5.4.17
v5.4.18
v5.4.19
v5.4.2
v5.4.20
v5.4.21
v5.4.22
v5.4.23
v5.4.24
v5.4.25
v5.4.26
v5.4.27
v5.4.28
v5.4.29
v5.4.3
v5.4.30
v5.4.31
v5.4.32
v5.4.33
v5.4.34
v5.4.35
v5.4.36
v5.4.37
v5.4.38
v5.4.39
v5.4.4
v5.4.40
v5.4.41
v5.4.42
v5.4.43
v5.4.44
v5.4.45
v5.4.46
v5.4.47
v5.4.48
v5.4.49
v5.4.5
v5.4.50
v5.4.51
v5.4.6
v5.4.7
v5.4.8
v5.4.9
v6.*
v6.0.0
v6.0.0-BETA1
v6.0.0-BETA2
v6.0.0-BETA3
v6.0.0-RC1
v6.1.0
v6.1.0-BETA1
v6.1.0-BETA2
v6.1.0-RC1
v6.2.0
v6.2.0-BETA1
v6.2.0-BETA2
v6.2.0-BETA3
v6.2.0-RC1
v6.3.0-BETA1
v6.3.0-BETA2
v6.3.0-BETA3
v6.3.0-RC1
v6.4.0
v6.4.0-BETA1
v6.4.0-BETA2
v6.4.0-BETA3
v6.4.0-RC1
v6.4.0-RC2
v6.4.1
v6.4.10
v6.4.11
v6.4.12
v6.4.13
v6.4.14
v6.4.15
v6.4.16
v6.4.17
v6.4.18
v6.4.19
v6.4.2
v6.4.20
v6.4.21
v6.4.22
v6.4.23
v6.4.24
v6.4.25
v6.4.26
v6.4.27
v6.4.28
v6.4.29
v6.4.3
v6.4.30
v6.4.31
v6.4.32
v6.4.33
v6.4.34
v6.4.35
v6.4.36
v6.4.37
v6.4.38
v6.4.39
v6.4.4
v6.4.5
v6.4.6
v6.4.7
v6.4.8
v6.4.9
v7.*
v7.0.0
v7.0.0-BETA1
v7.0.0-BETA2
v7.0.0-BETA3
v7.0.0-RC1
v7.0.0-RC2
v7.0.1
v7.1.0
v7.1.0-BETA1
v7.1.0-RC1
v7.2.0
v7.2.0-BETA1
v7.2.0-BETA2
v7.2.0-RC1
v7.2.1
v7.3.0
v7.3.0-BETA1
v7.3.0-BETA2
v7.3.0-RC1
v7.4.0
v7.4.0-BETA1
v7.4.0-BETA2
v7.4.0-RC1
v7.4.0-RC2
v7.4.0-RC3
v7.4.1
v7.4.10
v7.4.11
v7.4.2
v7.4.3
v7.4.4
v7.4.5
v7.4.6
v7.4.7
v7.4.8
v7.4.9
v8.*
v8.0.0
v8.0.1
v8.0.10
v8.0.11
v8.0.2
v8.0.3
v8.0.4
v8.0.5
v8.0.6
v8.0.7
v8.0.8
v8.0.9
Other
vPR3
vPR4
vPR5
vPR6
vPR8
vPR9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45070.json"