### Description `Symfony\Component\Mime\Address` is the value-object every Symfony Mailer address (to/cc/bcc/from/reply-to) flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary. The constructor accepts email addresses whose local-part (the part before `@`) is an RFC-5322 *quoted string* containing raw `\r\n` bytes — e.g. `"x\r\nBcc: attacker@evil"@example.com`. The stored address is later emitted verbatim into (1) the rendered message headers and (2) `SmtpTransport`'s `MAIL FROM:<...>` / `RCPT TO:<...>` protocol lines, turning the embedded CRLF into a new mail header and/or a new SMTP command. ### Resolution The `Address` constructor now rejects addresses containing line breaks. The patch for this issue is available [here](https://github.com/symfony/symfony/commit/dc2dbd29211eb4ddc451373fa1374fb926e94604) for branch 5.4. ### Credits We would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.

Multiple Vulnerabilities in Symfony

The version of Symfony and/or its Symfony Monolog Bridge / MIME / Mailer / Routing / Security HTTP Components installed on the remote host is/are prior to 6.1.x prior to 6.4.40, 7.0.x prior to 7.4.12, 8.0.x prior to 8.0.12, and, therefore, affected by multiple vulnerabilities:

  - An authentication bypass vulnerability exists in Symfony Component's X509Authenticator client-certificate     (mTLS) authentication due to use of an unanchored regex to extract the emailAddress from the Subject DN     string. An unauthenticated, remote attacker can exploit this, via a crafted client certificate containing     an emailAddress string embedded within the CN (Common Name) field, to bypass authentication and impersonate     arbitrary users. (CVE-2026-45063)

  - An unsafe deserialization vulnerability exists in Symfony Monolog Bridge Component's ServerLogCommand     (server:log console command) due to binding to all network interfaces (0.0.0.0:9911) by default and     performing unauthenticated PHP object deserialization without an allowed_classes, allowlist, or integrity     checks. An unauthenticated, remote attacker can exploit this, via crafted serialized PHP payloads sent to     TCP port 9911, to cause a denial of service or potentially achieve remote code execution through PHP object     injection with magic-method side effects, depending on available gadget chains in the target environment.
    (CVE-2026-45077)

  - A CRLF injection vulnerability exists in Symfony MIME Component's Address class due to the constructor     accepting email addresses with quoted local-parts containing raw \r\n bytes, despite being documented as     validating input. An authenticated, remote attacker can exploit this, via crafted email addresses with     embedded CRLF sequences in the local-part (e.g., 'x\r\nBcc: attacker@evil'@example.com), to inject arbitrary     email headers and SMTP commands, enabling unauthorized email disclosure, spam relay, or other mail-system     abuse. (CVE-2026-45067)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. Also note that this plugin does not distinguish between PHP packages installed via the OS package manager, PHP packages installed via Composer, or other sources. As a result, packages provided by your OS package repository may have backported fixes that this plugin may incorrectly report as vulnerable. Please refer to the OS-specific plugins for CVE-2026-45063, CVE-2026-45065, CVE-2026-45067, CVE-2026-45068, and CVE-2026-45077 to check for backported fixes.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6317 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6317-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 01, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : symfony     CVE ID         : CVE-2024-50340 CVE-2026-45063 CVE-2026-45065 CVE-2026-45067                      CVE-2026-45068 CVE-2026-45071 CVE-2026-45073 CVE-2026-45077                      CVE-2026-45133 CVE-2026-45304 CVE-2026-45305 CVE-2026-46626                      CVE-2026-48489 CVE-2026-48736 CVE-2026-48784

    Multiple vulnerabilities have been found in the Symfony PHP framework     which could lead to a bypass of security controls, cross-site scripting,     denial of service, SQL injection, email header injection, information     disclosure or code execution via PHP object deserialization.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 5.4.53+dfsg-0+deb12u1.

    We recommend that you upgrade your symfony packages.

    For the detailed security status of symfony please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/symfony

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6312 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6312-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     May 31, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : symfony     CVE ID         : CVE-2024-50340 CVE-2026-45063 CVE-2026-45064 CVE-2026-45065                      CVE-2026-45066 CVE-2026-45067 CVE-2026-45068 CVE-2026-45069                      CVE-2026-45071 CVE-2026-45072 CVE-2026-45073 CVE-2026-45077                      CVE-2026-45133 CVE-2026-45304 CVE-2026-45305 CVE-2026-45754                      CVE-2026-46626 CVE-2026-48489 CVE-2026-48736 CVE-2026-48760                      CVE-2026-48761 CVE-2026-48784

    Multiple vulnerabilities have been found in the Symfony PHP framework     which could lead to a bypass of security controls, cross-site scripting,     denial of service, SQL injection, email header injection, information     disclosure or code execution via PHP object deserialization.

    For the stable distribution (trixie), these problems have been fixed in     version 6.4.41+dfsg-0+deb13u1.

    We recommend that you upgrade your symfony packages.

    For the detailed security status of symfony please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/symfony

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  CVE-2026-45067


The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Debian Linux - symfony - None  Ubuntu Linux - [Unknown description] (CVE-2026-45067)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
318791	Symfony and Multiple Symfony Components < 5.4.52 / 6.x < 6.4.40 / 7.x < 7.4.12 / 8.x < 8.0.12 Multiple Vulnerabilities	Nessus	Misc.	high
318254	Debian dsa-6317 : php-symfony - security update	Nessus	Debian Local Security Checks	critical
318121	Debian dsa-6312 : php-symfony - security update	Nessus	Debian Local Security Checks	critical
442416	SCA: security update for symfony/mime, symfony/symfony (GHSA-qpmx-3rfj-7rhv)	Tenable Cloud Security	SCA Checks	high
442416	SCA: security update for symfony/mime, symfony/symfony (GHSA-qpmx-3rfj-7rhv)	Tenable Self-Hosted Container Security	SCA Checks	high
316025	Linux Distros Unpatched Vulnerability : CVE-2026-45067	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-45067

medium

Tenable Plugins

Coming Soon

high

critical

critical

high

high

critical