--- title: About the security entries in Symfony 5.4.55, 6.4.49,... description: Symfony 5.4.55, 6.4.49, 7.4.22 and 8.1.10 fix CVE-2026-45070, an email header injection flaw through Mime header parameter names. An earlier fix announced for... canonical: https://daily.dev/posts/about-the-security-entries-in-symfony-5-4-55-6-4-49-7-4-22-and-8-1-10-symfony-blog--pqbi9fqqf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: About the security entries in Symfony 5.4.55, 6.4.49, 7.4.22 and 8.1.10 (Symfony Blog) | daily.dev og:description: Symfony 5.4.55, 6.4.49, 7.4.22 and 8.1.10 fix CVE-2026-45070, an email header injection flaw through Mime header parameter names. An earlier fix announced for... og:url: https://daily.dev/posts/about-the-security-entries-in-symfony-5-4-55-6-4-49-7-4-22-and-8-1-10-symfony-blog--pqbi9fqqf og:image: https://api.daily.dev/og/posts/PQbi9fQqf.png og:image:alt: About the security entries in Symfony 5.4.55, 6.4.49, 7.4.22 and 8.1.10 (Symfony Blog) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # About the security entries in Symfony 5.4.55, 6.4.49, 7.4.22 and 8.1.10 (Symfony Blog) **[Symfony](https://daily.dev/sources/symfony)** · 2 min read · 0 upvotes · 0 comments ## Summary Symfony 5.4.55, 6.4.49, 7.4.22 and 8.1.10 fix CVE-2026-45070, an email header injection flaw through Mime header parameter names. An earlier fix announced for 5.4.52, 6.4.40, 7.4.12 and 8.0.12 was never merged into any maintenance branch, so no prior release contained it. Symfony 8.0 is no longer maintained, so 8.0 users must upgrade to 8.1.10. Upgrade if your application builds Mime headers using parameter names from user input. The same changelogs also relist CVE-2026-109413, CVE-2026-108082 and CVE-2026-109449, but those were already fixed earlier; they reappear because of how merge commits were prepared for 5.4.54 on October 15. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Is Symfony's CVE-2026-45070 email header injection fix actually included in version 5.4.52 or 6.4.40? No, despite being announced as fixed in 5.4.52, 6.4.40, 7.4.12 and 8.0.12, the commit was never merged into any maintenance branch so none of those releases contained it. The real fix for CVE-2026-45070, an email header injection through parameter names in Mime headers, only landed in Symfony 5.4.55, 6.4.49, 7.4.22 and 8.1.10. _Teams tracking Symfony security patches can follow confirmed fix versions on daily.dev before upgrading._ ### Why do Symfony 6.4.49 and 7.4.22 changelogs list CVEs that were already patched earlier? Those changelog entries for CVE-2026-109413, CVE-2026-108082 and CVE-2026-109449 don't reflect new code changes. The fixes were already released earlier on the 6.4 and 7.4 branches; they reappear because merge commits for each CVE were recreated on 5.4 (fixed in 5.4.54 on October 15) and only reached the newer branches with this release. _Developers auditing dependency changelogs for real security changes can double-check advisories surfaced on daily.dev._ ### Do I need to upgrade from Symfony 8.0 to patch CVE-2026-45070? Yes, Symfony 8.0 is no longer maintained, so users on that branch must upgrade to 8.1.10 to get the fix for CVE-2026-45070. Upgrading matters specifically if the application builds Mime headers using parameter names that come from user input. _Developers planning Symfony upgrades can track which branches still receive security fixes via daily.dev._ ## Similar posts on daily.dev - [CVE-2026-45070: Email Header Injection via Non-Token Characters in Mime Parameter Names \(Symfony Blog\)](https://daily.dev/posts/cve-2026-45070-email-header-injection-via-non-token-characters-in-mime-parameter-names-symfony-blo-ftprhukuv) · Symfony · 0 upvotes · 0 comments - [Symfony 5.4.55 released \(Symfony Blog\)](https://daily.dev/posts/symfony-5-4-55-released-symfony-blog--hce5auvy9) · Symfony · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php), [#symfony](https://daily.dev/tags/symfony) [View this post on daily.dev](https://daily.dev/posts/about-the-security-entries-in-symfony-5-4-55-6-4-49-7-4-22-and-8-1-10-symfony-blog--pqbi9fqqf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"About the security entries in Symfony 5.4.55, 6.4.49, 7.4.22 and 8.1.10 (Symfony Blog)","url":"https://daily.dev/posts/about-the-security-entries-in-symfony-5-4-55-6-4-49-7-4-22-and-8-1-10-symfony-blog--pqbi9fqqf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/about-the-security-entries-in-symfony-5-4-55-6-4-49-7-4-22-and-8-1-10-symfony-blog--pqbi9fqqf"},"datePublished":"2026-10-29T09:57:20.819Z","dateModified":"2026-10-29T09:57:50.139Z","description":"Symfony 5.4.55, 6.4.49, 7.4.22 and 8.1.10 fix CVE-2026-45070, an email header injection flaw through Mime header parameter names. An earlier fix announced for...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/327b244859fddae8f3a20d0225898aa0?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/327b244859fddae8f3a20d0225898aa0?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Symfony","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Symfony","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/cc07051b7112472f9729e73c14660a64","url":"https://daily.dev/sources/symfony"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/about-the-security-entries-in-symfony-5-4-55-6-4-49-7-4-22-and-8-1-10-symfony-blog--pqbi9fqqf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,php,symfony","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Symfony","item":"https://daily.dev/sources/symfony"},{"@type":"ListItem","position":3,"name":"About the security entries in Symfony 5.4.55, 6.4.49, 7.4.22 and 8.1.10 (Symfony Blog)"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/about-the-security-entries-in-symfony-5-4-55-6-4-49-7-4-22-and-8-1-10-symfony-blog--pqbi9fqqf#faq","mainEntity":[{"@type":"Question","name":"Is Symfony's CVE-2026-45070 email header injection fix actually included in version 5.4.52 or 6.4.40?","acceptedAnswer":{"@type":"Answer","text":"No, despite being announced as fixed in 5.4.52, 6.4.40, 7.4.12 and 8.0.12, the commit was never merged into any maintenance branch so none of those releases contained it. The real fix for CVE-2026-45070, an email header injection through parameter names in Mime headers, only landed in Symfony 5.4.55, 6.4.49, 7.4.22 and 8.1.10. Teams tracking Symfony security patches can follow confirmed fix versions on daily.dev before upgrading."}},{"@type":"Question","name":"Why do Symfony 6.4.49 and 7.4.22 changelogs list CVEs that were already patched earlier?","acceptedAnswer":{"@type":"Answer","text":"Those changelog entries for CVE-2026-109413, CVE-2026-108082 and CVE-2026-109449 don't reflect new code changes. The fixes were already released earlier on the 6.4 and 7.4 branches; they reappear because merge commits for each CVE were recreated on 5.4 (fixed in 5.4.54 on October 15) and only reached the newer branches with this release. Developers auditing dependency changelogs for real security changes can double-check advisories surfaced on daily.dev."}},{"@type":"Question","name":"Do I need to upgrade from Symfony 8.0 to patch CVE-2026-45070?","acceptedAnswer":{"@type":"Answer","text":"Yes, Symfony 8.0 is no longer maintained, so users on that branch must upgrade to 8.1.10 to get the fix for CVE-2026-45070. Upgrading matters specifically if the application builds Mime headers using parameter names that come from user input. Developers planning Symfony upgrades can track which branches still receive security fixes via daily.dev."}}]} ```