Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
The symfony/mime and symfony/symfony packages are affected in versions before 5.4.52, from 6.0.0 before 6.4.40, from 7.0.0 before 7.4.12, and from 8.0.0 before 8.0.12. The Address value object accepted local-parts containing raw line breaks, which could then be emitted into message headers and SMTP commands. The source does not say what an attacker must control or do beyond this; it advises upgrading to 5.4.52, 6.4.40, 7.4.12, or 8.0.12, where the constructor rejects addresses containing line breaks.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 6.3 | Medium | 4.0 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0060, the 49th percentile, on 13 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 20 May 2026, 10:21 UTC Published by the maintainers as a GitHub repository advisory
- 31 Oct 2026, 14:01 UTC First seen by agentprime
- 31 Oct 2026, 14:01 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-qpmx-3rfj-7rhv
- OSV: GHSA-qpmx-3rfj-7rhv
- github.com/symfony/symfony/security/advisories/GHSA-qpmx-3rfj-7rhv
- github.com/symfony/symfony/commit/dc2dbd29211eb4ddc451373fa1374fb926e94604
- github.com/FriendsOfPHP/security-advisories/blob/master/symfony/mime/CVE-2026-45067.yaml
- github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45067.yaml
- github.com/symfony/symfony
- symfony.com/cve-2026-45067