GIVE YOUR AGENT THE EVIDENCE

Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

GIVE YOUR AGENT THE EVIDENCE

Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

cve.new
Check your stack
GHSA-vqc8-7275-q272medium4.9

Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names

Impact

Symfony\Component\Mime\Header\ParameterizedHeader (and the related parameter handling reachable from Symfony\Component\Mime\Header\Headers) is responsible for serializing structured headers such as Content-Type and Content-Disposition, which carry key=value parameters (e.g. Content-Disposition: attachment; filename="x").

Source excerpt · OSV
Applies when

RFC 2045 / RFC 5322 require parameter names to be tokens: a restricted ASCII subset that excludes whitespace, CR/LF, and the tspecials set.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

symfony/mime Packagist
Affected rangeRecorded fix
Earlier releases before 5.4.52Ecosystem versions5.4.52
From 6.0.0 before 6.4.40Ecosystem versions6.4.40
From 7.0.0 before 7.4.12Ecosystem versions7.4.12
From 8.0.0 before 8.0.12Ecosystem versions8.0.12

Version evidence: OSV · GHSA-vqc8-7275-q272

View original version evidence (259 explicit versions)
symfony/symfony Packagist
Affected rangeRecorded fix
Earlier releases before 5.4.52Ecosystem versions5.4.52
From 6.0.0 before 6.4.40Ecosystem versions6.4.40
From 7.0.0 before 7.4.12Ecosystem versions7.4.12
From 8.0.0 before 8.0.12Ecosystem versions8.0.12

Version evidence: OSV · GHSA-vqc8-7275-q272

View original version evidence (833 explicit versions)

Original source description

Description

Symfony\Component\Mime\Header\ParameterizedHeader (and the related parameter handling reachable from Symfony\Component\Mime\Header\Headers) is responsible for serializing structured headers such as Content-Type and Content-Disposition, which carry key=value parameters (e.g. Content-Disposition: attachment; filename="x").

RFC 2045 / RFC 5322 require parameter names to be tokens: a restricted ASCII subset that excludes whitespace, CR/LF, and the tspecials set. Symfony's parameter handling validates and properly encodes parameter values, but does not validate parameter names: the supplied name is emitted verbatim into the serialized header.

A caller that derives a parameter name from untrusted input, e.g. an application that lets a user influence a Content-Disposition parameter name, can include \r\n or other non-token bytes inside the name, terminating the current header and injecting additional headers in the rendered message. This is the classic CRLF / header-injection primitive applied to the parameter-name slot.

Resolution

ParameterizedHeader now rejects parameter names that contain bytes outside the RFC token character class.

The patch for this issue is available here for branch 5.4.

Credits

Symfony would like to thank Fabian Fleischer for reporting the issue and Alexandre Daubois for fixing it.

References