CVE-2026-45067: Symfony Mailer Address XSS Vulnerability

CVE-2026-45067 Overview

CVE-2026-45067 is a CRLF (Carriage Return Line Feed) injection vulnerability in the Symfony Mime component's Address class. The Symfony\Component\Mime\Address value object handles every mailer address (to, cc, bcc, from, reply-to) in Symfony applications. Its constructor is documented as validating input and throwing exceptions on invalid addresses, so developers rely on it as a security boundary.

The constructor accepts email addresses whose local-part is an RFC-5322 quoted string containing raw \r\n bytes. Attackers can inject additional mail headers or SMTP protocol commands through crafted address strings. This affects both rendered message headers and SmtpTransportMAIL FROM and RCPT TO protocol lines.

Critical Impact
Attackers can inject arbitrary email headers or SMTP commands through crafted email addresses, enabling hidden BCC recipients, spoofed headers, or SMTP command injection in vulnerable Symfony Mailer deployments.

Affected Products

Symfony 5.4.x prior to 5.4.52
Symfony 6.4.x prior to 6.4.40
Symfony 7.4.x prior to 7.4.12
Symfony 8.0.x prior to 8.0.12

Discovery Timeline

2026-07-14 - CVE-2026-45067 published to NVD
2026-07-14 - Last updated in NVD database
Credits: Claude Mythos Preview (via Project Glasswing) reported the issue and provided the fix

Technical Details for CVE-2026-45067

Vulnerability Analysis

The vulnerability is classified as [CWE-93] Improper Neutralization of CRLF Sequences. The Address constructor validates addresses using RFC 2822 compliance checks but does not reject control characters embedded in RFC-5322 quoted local-parts. A local-part like "x\r\nBcc: attacker@evil"@example.com passes validation as a syntactically legal quoted string.

The stored address is later emitted verbatim into two sensitive contexts. First, the rendered message headers include the address unmodified, allowing an injected \r\n sequence to terminate the current header and inject new ones such as Bcc:. Second, SmtpTransport writes the address into MAIL FROM:<...> and RCPT TO:<...> SMTP commands, where CRLF bytes terminate the current SMTP command and inject arbitrary new ones.

Root Cause

The root cause is missing input sanitization for control characters in the Address constructor. While name fields were stripped of \n and \r characters, the address field only received a trim() call before RFC validation. RFC 2822 permits quoted-string local-parts, so raw CRLF sequences inside quotes passed the compliance check without being flagged.

Attack Vector

Any application that constructs Address objects from untrusted user input, such as contact forms, newsletter signups, or account registration flows, is exploitable. An attacker submits an email address containing an embedded CRLF sequence followed by an SMTP command or mail header. When Symfony Mailer processes the message, the injected content executes as part of the mail protocol stream.

php

         $this->address = trim($address);
         $this->name = trim(str_replace(["\n", "\r"], '', $name));
 
+        if (preg_match('/[\\x00-\\x1F\\x7F]/', $this->address)) {
+            throw new InvalidArgumentException('Email address contains control characters.');
+        }
+
         if (!self::$validator->isValid($this->address, class_exists(MessageIDValidation::class) ? new MessageIDValidation() : new RFCValidation())) {
             throw new RfcComplianceException(sprintf('Email "%s" does not comply with addr-spec of RFC 2822.', $address));
         }

Source: Symfony patch commit a1c42cbe. The patch adds a preg_match check that rejects any control character in the \\x00-\\x1F or \\x7F range before the RFC validation step.

Detection Methods for CVE-2026-45067

Indicators of Compromise

Outbound SMTP traffic containing unexpected Bcc: headers or additional recipients that do not appear in application logs.
Email addresses in application logs containing quoted local-parts with embedded whitespace, \r, or \n byte sequences.
RfcComplianceException or InvalidArgumentException spikes after patching, indicating prior injection attempts.

Detection Strategies

Inspect web application request logs for email input fields containing URL-encoded %0d, %0a, or raw CRLF characters.
Correlate mail server delivery logs against application-recorded recipient lists to identify recipient injection.
Deploy web application firewall (WAF) rules that flag email parameters containing control characters.

Monitoring Recommendations

Enable verbose SMTP transport logging to capture MAIL FROM and RCPT TO values dispatched by the application.
Monitor Symfony application error logs for RfcComplianceException events referencing the Address class after patching.
Track composer dependency inventories to identify hosts still running vulnerable symfony/mime package versions.

How to Mitigate CVE-2026-45067

Immediate Actions Required

Upgrade symfony/mime to a patched release: 5.4.52, 6.4.40, 7.4.12, or 8.0.12 depending on your major version.
Audit application code that constructs Address objects from user-supplied input and add pre-validation to reject control characters.
Review outbound mail logs for the last 90 days to identify any injection attempts against contact or notification workflows.

Patch Information

The patch is available in the Symfony 5.4 branch commit dc2dbd29 and merged in commit a1c42cbe. Patched releases: v5.4.52, v6.4.40, v7.4.12, and v8.0.12. See GHSA-qpmx-3rfj-7rhv for the full advisory.

Workarounds

Add input validation before instantiating Address objects to reject strings containing \r, \n, or other control characters.
Enforce a stricter email regex that disallows quoted local-parts entirely for user-supplied inputs.
Restrict SMTP relay permissions so compromised applications cannot inject arbitrary recipients into the delivery stream.

bash

# Composer upgrade command for patched Symfony Mime release
composer require symfony/mime:^6.4.40 --update-with-dependencies