AIKIDO-2026-10880
symfony/mime is vulnerable to CRLF Injection
65
Medium Risk
This Affects:
symfony/mimeTL;DR
ParameterizedHeader validates parameter values but emits parameter names verbatim. A caller that derives a MIME parameter name from untrusted input can include CRLF or other non-token bytes. Pre-fix messages can contain injected headers when structured headers are serialized. The fix rejects parameter names outside the RFC token character class.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
symfony/mime is vulnerable to CRLF Injection in versions 0.0.1 - 5.4.51, 6.0.0 - 6.4.39, 7.0.0 - 7.4.11 and 8.0.0 - 8.0.11.
How to fix this
Upgrade the symfony/mime and/or symfony/symfony library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant