symfony/telegram-notifier-v8.0.0: 2 vulnerabilities (highest severity is: 5.3)

[mend-bolt-for-github]

Vulnerable Library - symfony/telegram-notifier-v8.0.0

Found in HEAD commit: 45fd85ad85cccc095b1d85471b9b73160b3006a7

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (symfony/telegram-notifier-v8.0.0 version)	Remediation Possible**
CVE-2026-45070	Medium	5.3	symfony/mime-v8.0.0	Transitive	N/A*	❌
CVE-2026-45067	Medium	5.3	symfony/mime-v8.0.0	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-45070

Vulnerable Library - symfony/mime-v8.0.0

Allows manipulating MIME messages

Library home page: https://api.github.com/repos/symfony/mime/zipball/7576ce3b2b4d3a2a7fe7020a07a392065d6ffd40

Dependency Hierarchy:

• symfony/telegram-notifier-v8.0.0 (Root Library)
  • ❌ symfony/mime-v8.0.0 (Vulnerable Library)

Found in HEAD commit: 45fd85ad85cccc095b1d85471b9b73160b3006a7

Found in base branch: develop

Vulnerability Details

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Mime\Header\ParameterizedHeader validates and encodes parameter values but emits parameter names verbatim, allowing a caller that derives a parameter name from untrusted input to include CRLF or other non-token bytes and inject additional headers into rendered structured mail headers such as Content-Type or Content-Disposition. This issue is reported as fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Publish Date: 2026-07-14

URL: CVE-2026-45070

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-05-27

Fix Resolution: https://github.com/symfony/symfony.git - v7.4.10,https://github.com/symfony/symfony.git - v5.4.52,https://github.com/symfony/symfony.git - v8.0.10,https://github.com/symfony/symfony.git - v6.4.38

Step up your Open Source Security Game with Mend here

CVE-2026-45067

Vulnerable Library - symfony/mime-v8.0.0

Allows manipulating MIME messages

Library home page: https://api.github.com/repos/symfony/mime/zipball/7576ce3b2b4d3a2a7fe7020a07a392065d6ffd40

Dependency Hierarchy:

• symfony/telegram-notifier-v8.0.0 (Root Library)
  • ❌ symfony/mime-v8.0.0 (Vulnerable Library)

Found in HEAD commit: 45fd85ad85cccc095b1d85471b9b73160b3006a7

Found in base branch: develop

Vulnerability Details

Description
"Symfony\Component\Mime\Address" is the value-object every Symfony Mailer address (to/cc/bcc/from/reply-to) flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary.
The constructor accepts email addresses whose local-part (the part before "@") is an RFC-5322 quoted string containing raw "\r\n" bytes — e.g. ""x\r\nBcc: attacker@evil"@⁠example.com". The stored address is later emitted verbatim into (1) the rendered message headers and (2) "SmtpTransport"'s "MAIL FROM:<...>" / "RCPT TO:<...>" protocol lines, turning the embedded CRLF into a new mail header and/or a new SMTP command.
Resolution
The "Address" constructor now rejects addresses containing line breaks.
The patch for this issue is available "here" (symfony/symfony@dc2dbd2) for branch 5.4.
Credits
We would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2026-07-14

URL: CVE-2026-45067

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-05-27

Fix Resolution: https://github.com/symfony/symfony.git - v8.0.10,https://github.com/symfony/symfony.git - v6.4.38,https://github.com/symfony/symfony.git - v5.4.52,https://github.com/symfony/symfony.git - v7.4.10

Step up your Open Source Security Game with Mend here