The Symfony\Component\Mime\Address constructor, which validates email addresses for the Symfony Mailer, improperly accepts addresses whose local-part is an RFC-5322 quoted string containing raw CRLF (\r\n) bytes. These embedded line breaks can be exploited to inject additional mail headers or SMTP commands when the address is emitted verbatim into message headers or SMTP MAIL FROM/RCPT TO commands. The vulnerability is addressed by patching the constructor to reject addresses containing line breaks. The fix is available in Symfony branch 5.4.

An attacker can craft email addresses with embedded CRLF sequences that lead to injection of new mail headers or SMTP commands. This can potentially be used to manipulate email message structure or SMTP transactions, which may affect mail delivery or enable further attacks relying on mail header injection. No direct evidence of exploits in the wild is reported.

A patch is available that updates the Address constructor to reject email addresses containing line breaks. Users should apply the official fix from Symfony branch 5.4 or later versions that include this patch. Until patched, avoid processing untrusted email addresses with the vulnerable versions.