composer

symfony/mime

Security advisories for symfony/mime, newest first. 3 known, all fixed. If you’re on 8.1.10 or later, none of them affect you.

RSS feed Check your lock file →

Latest version

8.1.10

Advisories

3 · 0 unfixed

Last advisory

28 Oct 2026

Safe from

8.1.10

3 advisories · newest first

MODERATE 28 Oct 2026

CVE-2026-45070: Email Header Injection via Non-Token Characters in Mime Parameter Names

PKSA-wtxr-p26d-nn42 · CVE-2026-45070

Affected

≥ 2.0.0, < 5.4.55 ≥ 6.0.0, < 6.4.49 ≥ 7.0.0, < 7.4.22

and 1 more

≥ 8.0.0, < 8.1.10

Fixed in

5.4.55 6.4.49 7.4.22

and 1 more

8.1.10

Published

28 Oct 2026

HIGH 20 May 2026

CVE-2026-45067: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address

PKSA-2n2k-66v2-bwg3 · CVE-2026-45067

Affected

≥ 2.0.0, < 5.4.52 ≥ 6.0.0, < 6.4.40 ≥ 7.0.0, < 7.4.12

and 1 more

≥ 8.0.0, < 8.0.12

Fixed in

5.4.52 6.4.40 7.4.12

and 1 more

8.0.12

Published

20 May 2026

HIGH7.5 13 Nov 2019

CVE-2019-18888: Prevent argument injection in a MimeTypeGuesser

PKSA-7y15-t1fp-w94f · CVE-2019-18888

Affected

≥ 4.3.0, < 4.3.8

Fixed in

4.3.8

Published

13 Nov 2019

/advisories/composer/symfony/mime/feed.rss

From Packagist and the GitHub advisory database · synced hourly

Same vendor

symfony/cache3 advisories symfony/dom-crawler1 advisory symfony/error-handler1 advisory symfony/expression-language1 advisory symfony/http-client2 advisories symfony/http-foundation15 advisories symfony/http-kernel8 advisories symfony/mailer1 advisory

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →