CVE-2026-45070: Symfony Header Injection Vulnerability

CVE-2026-45070 Overview

CVE-2026-45070 is a header injection vulnerability [CWE-93] in the Symfony PHP framework's Mime component. The Symfony\Component\Mime\Header\ParameterizedHeader class validates and encodes parameter values but emits parameter names verbatim. When a caller derives a parameter name from untrusted input, attackers can inject CRLF sequences or other non-token bytes. This allows injection of additional headers into rendered structured mail headers such as Content-Type or Content-Disposition. The issue affects Symfony versions prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Critical Impact
Attackers can inject arbitrary MIME headers into outbound email messages, enabling message tampering, content spoofing, and potential email-based attacks against downstream recipients.

Affected Products

Symfony versions prior to 5.4.52
Symfony versions prior to 6.4.40
Symfony versions prior to 7.4.12 and 8.0.12

Discovery Timeline

2026-07-14 - CVE-2026-45070 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-45070

Vulnerability Analysis

The vulnerability resides in Symfony's Mime component, specifically in the ParameterizedHeader class. This class constructs structured mail headers that include parameters such as Content-Type: text/plain; charset=utf-8 or Content-Disposition: attachment; filename="report.pdf". Symfony properly validates and encodes the parameter values but performs no validation on the parameter names themselves.

When an application derives parameter names from user-controlled input, an attacker can supply names containing carriage return and line feed (CRLF) sequences. These bytes terminate the current header and inject new ones into the serialized output, following the classic CRLF injection pattern described in [CWE-93].

Exploitation depends on how the calling application uses the Mime component. Applications that pass untrusted data directly as parameter names are vulnerable. The impact is limited to integrity of email messages, with no direct confidentiality or availability effect on the sending system.

Root Cause

The root cause is missing input validation on parameter names in the ParameterizedHeader class. The component enforces RFC token rules for values but omits equivalent checks for names, breaking the invariant that serialized headers conform to RFC 5322 grammar.

Attack Vector

Exploitation requires an application code path that concatenates or passes untrusted input as a parameter name to the Mime component. An attacker submits input containing \r\n sequences followed by attacker-controlled header content. The resulting email message contains injected headers or an altered body structure when rendered.

php

// Vulnerable pattern - untrusted input used as parameter name
// The patch adds validation via RfcComplianceException
namespace Symfony\Component\Mime\Header;

use Symfony\Component\Mime\Encoder\Rfc2231Encoder;
use Symfony\Component\Mime\Exception\RfcComplianceException;

/**
 * @author Chris Corbyn
 */

Source: Symfony patch commit e62ea21

The patch introduces an RfcComplianceException that is thrown when parameter names contain non-token characters, preventing serialization of malformed headers.

Detection Methods for CVE-2026-45070

Indicators of Compromise

Outbound email messages containing unexpected Content-Type or Content-Disposition header entries.
Mail server logs showing MIME parts with malformed or duplicated header names.
PHP application logs containing user input with embedded \r\n byte sequences reaching mail-sending code paths.

Detection Strategies

Perform static analysis on PHP codebases to identify calls into ParameterizedHeader where parameter names are sourced from request data.
Inspect Composer lock files (composer.lock) across your fleet for Symfony Mime component versions below 5.4.52, 6.4.40, 7.4.12, or 8.0.12.
Deploy web application firewall rules that flag HTTP request parameters containing CRLF sequences destined for mail-handling endpoints.

Monitoring Recommendations

Monitor outbound SMTP traffic for messages containing anomalous header structures or unexpected recipient headers.
Alert on RfcComplianceException events in application logs after patching, as these indicate attempted exploitation.
Track dependency inventory changes to confirm patched Symfony versions are deployed across all environments.

How to Mitigate CVE-2026-45070

Immediate Actions Required

Upgrade Symfony to 5.4.52, 6.4.40, 7.4.12, or 8.0.12 depending on the branch in use.
Audit application code for locations where user-controlled input flows into MIME parameter names.
Sanitize or reject any input containing CR, LF, or other non-token bytes before passing it to mail-building routines.

Patch Information

The fix is available in Symfony releases v5.4.52, v6.4.40, v7.4.12, and v8.0.12. The patch commit is documented in GitHub commit e62ea21. Full technical details are published in GitHub Security Advisory GHSA-vqc8-7275-q272.

Workarounds

Enforce strict allowlists for any application input used as MIME parameter names, restricting to RFC 2045 token characters.
Wrap calls to ParameterizedHeader with a validation layer that rejects names containing bytes outside [A-Za-z0-9!#$%&'*+\-.^_|~]`.
Route outbound mail through a hardened relay that normalizes or rejects messages with malformed MIME headers.

bash

# Update Symfony via Composer to a patched release
composer require symfony/mime:^7.4.12
composer update symfony/mime

# Verify installed version
composer show symfony/mime | grep versions