PKSA-wtxr-p26d-nn42: CVE-2026-45070: Email Header Injection via Non-Token Characters in Mime Parameter Names

Published Oct 28, 2026

Updated

CVE-2026-45070: Email Header Injection via Non-Token Characters in Mime Parameter Names

Affected Software

19 affected componentsFixes available

composer/symfony/mime>=2.0.0, <3.0.0

composer/symfony/mime>=3.0.0, <4.0.0

composer/symfony/mime>=4.0.0, <5.0.0

composer/symfony/mime>=5.0.0, <5.1.0

composer/symfony/mime>=5.1.0, <5.2.0

composer/symfony/mime>=5.2.0, <5.3.0

composer/symfony/mime>=5.3.0, <5.4.0

composer/symfony/mime>=5.4.0, <5.4.55

5.4.55

composer/symfony/mime>=6.0.0, <6.1.0

composer/symfony/mime>=6.1.0, <6.2.0

composer/symfony/mime>=6.2.0, <6.3.0

composer/symfony/mime>=6.3.0, <6.4.0

composer/symfony/mime>=6.4.0, <6.4.49

6.4.49

composer/symfony/mime>=7.0.0, <7.1.0

composer/symfony/mime>=7.1.0, <7.2.0

composer/symfony/mime>=7.3.0, <7.4.0

composer/symfony/mime>=7.4.0, <7.4.22

7.4.22

composer/symfony/mime>=8.0.0, <8.1.0

composer/symfony/mime>=8.1.0, <8.1.10

8.1.10

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/symfony/mime to a version that resolves this vulnerability.
Fixed in 5.4.55
Upgrade
Upgrade composer/symfony/mime to a version that resolves this vulnerability.
Fixed in 6.4.49
Upgrade
Upgrade composer/symfony/mime to a version that resolves this vulnerability.
Fixed in 7.4.22
Upgrade
Upgrade composer/symfony/mime to a version that resolves this vulnerability.
Fixed in 8.1.10

Oct 28, 2026

Advisory Published

via Packagist·06:08 PM

Data Sourced

via Packagist·06:08 PM

DescriptionSeverityAffected Software