CVE-2026-45070

Name of the Vulnerable Software and Affected Versions Symfony (affected versions not specified)

Description The ParameterizedHeader class (and related parameter handling in Headers) fails to validate parameter names when serializing structured headers like Content-Type and Content-Disposition. While parameter values are encoded, names are emitted verbatim. If an application allows untrusted input to influence a parameter name, an attacker can inject r (CRLF) or other non-token bytes. This allows the termination of the current header and the injection of additional headers into the rendered message, a technique known as header injection.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.