Yesterday, we released Symfony 5.4.55, 6.4.49, 7.4.22 and 8.1.10. Their changelogs list security fixes that were announced before, which confused some of you. Here is what these releases change, and what you should do.
CVE-2026-45070 is fixed only now
In May, we published CVE-2026-45070, an email header injection through the names of parameters in Mime headers. We said it was fixed in 5.4.52, 6.4.40, 7.4.12 and 8.0.12. That was wrong. The fix was committed, but this commit was never merged into a maintenance branch, so no release contained it. Several of you reported it to us, thank you.
The fix is now in 5.4.55, 6.4.49, 7.4.22 and 8.1.10. Symfony 8.0 is not maintained anymore, so 8.0 users have to upgrade to 8.1.10. We updated the advisory and the CVE blog post with the right versions.
Upgrade if your application builds Mime headers with parameter names that come from user input.
The other security entries
The changelogs of 6.4.49, 7.4.22 and 8.1.10 also list CVE-2026-109413, CVE-2026-108082 and CVE-2026-109449. These releases change nothing for them: their fixes were released earlier on these branches.
| CVE | Component | 6.4 | 7.4 | 8.1 |
|---|---|---|---|---|
| CVE-2026-109413 | Yaml | 6.4.45 | 7.4.18 | 8.1.6 |
| CVE-2026-108082 | HttpFoundation | 6.4.46 | 7.4.19 | 8.1.7 |
| CVE-2026-109449 | ExpressionLanguage | 6.4.48 | 7.4.21 | 8.1.9 |
On 5.4, all three were fixed in 5.4.54, released on October 15.
These entries come from how we prepared 5.4.54. To give each CVE its own merge commit on 5.4, we merged their fixes into 5.4 once more. These merge commits don't change any code. They reached the newer branches only with this release, so the changelogs list them again.