High
CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay
Type: advisorySources: OSV
Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-48019
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 20:20 UTC · Revision 1
Source evidence
CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay
core-osv · Original sourcePublished 4 Sept 2026, 22:11 UTC
Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0.
osv:CVE-2026-48019
Complete source record
{
"id": "8098cceec2b713e156d57f5f4b29dd648b555be56a9114f05edca0bda36b4e62",
"url": "https://osv.dev/vulnerability/CVE-2026-48019",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay",
"summary": "Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0.",
"evidence": "osv:CVE-2026-48019",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-48019",
"aliases": [
"CVE-2026-48019",
"GHSA-5vg9-5847-vvmq"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/laravel/framework",
"type": "GIT",
"events": [
{
"introduced": "3e33f431a05365d008742ff8001b92641086d5f8"
},
{
"fixed": "e36708519b893d78c2fede3d26ccac23f400368d"
},
{
"introduced": "0"
},
{
"fixed": "b39ddd3fea8c93ccd3ec10c2472e9ea5167494f2"
},
{
"fixed": "96e9a663db657cf37ef26cd794fda8ff60eaa451"
},
{
"fixed": "f336ba79e744257f84ebf0d096b0ebc62e8e1a4d"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "13.0.0"
},
{
"fixed": "13.10.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "0"
},
{
"fixed": "12.60.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "96e9a663db657cf37ef26cd794fda8ff60eaa451"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "f336ba79e744257f84ebf0d096b0ebc62e8e1a4d"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "b39ddd3fea8c93ccd3ec10c2472e9ea5167494f2"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v12.60.0"
},
{
"range": [
{
"fixed": "e36708519b893d78c2fede3d26ccac23f400368d"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v13.10.0"
}
]
}
}
],
"versions": [
"v12.59.0",
"v13.9.0",
"v13.8.0",
"v13.7.0",
"v12.58.0",
"v12.57.0",
"v13.6.0",
"v13.5.0",
"v13.4.0",
"v13.3.0",
"v12.56.0",
"v13.2.0",
"v13.1.1",
"v13.1.0",
"v12.55.1",
"v13.0.0",
"v12.55.0",
"v12.54.1",
"v12.54.0",
"v12.53.0",
"v12.52.0",
"v12.51.0",
"v12.50.0",
"v12.49.0",
"v12.48.1",
"v12.48.0",
"v12.47.0",
"v12.46.0",
"v12.45.2",
"v12.45.1",
"v12.45.0",
"v12.44.0",
"v12.43.1",
"v12.43.0",
"v12.42.0",
"v12.41.1",
"v12.41.0",
"v12.40.2",
"v12.40.0",
"v12.40.1",
"v12.39.0",
"v12.38.1",
"v12.38.0",
"v12.37.0",
"v12.36.1",
"v12.36.0",
"v12.35.1",
"v12.35.0",
"v12.34.0",
"v12.33.0",
"v12.32.5",
"v12.32.4",
"v12.32.3",
"v12.32.2",
"v12.32.1",
"v12.32.0",
"v12.31.1",
"v12.31.0",
"v12.30.1",
"v12.30.0",
"v12.29.0",
"v12.28.1",
"v12.28.0",
"v12.27.1",
"v12.26.4",
"v12.26.3",
"v12.26.2",
"v12.26.1",
"v12.26.0",
"v12.25.0",
"v12.24.0",
"v12.23.1",
"v12.23.0",
"v12.22.1",
"v12.22.0",
"v12.21.0",
"v12.20.0",
"v12.19.3",
"v12.19.2",
"v12.19.1",
"v12.19.0",
"v12.18.0",
"v12.17.0",
"v12.16.0",
"v12.15.0",
"v12.14.1",
"v12.14.0",
"v12.13.0",
"v12.12.0",
"v12.11.1",
"v12.11.0",
"v12.10.2",
"v12.10.1",
"v12.10.0",
"v12.9.2",
"v12.9.1",
"v12.9.0",
"v12.8.1",
"v12.8.0",
"v12.7.2",
"v12.7.1",
"v12.7.0",
"v12.6.0",
"v12.5.0",
"v12.4.1",
"v12.4.0",
"v12.3.0",
"v12.2.0",
"v12.1.1",
"v12.1.0",
"v12.0.1",
"v12.0.0",
"v9.0.0-beta.1",
"v8.17.2",
"v8.17.1",
"v8.17.0",
"v8.16.0",
"v8.15.0",
"v8.14.0",
"v8.13.0",
"v8.12.3",
"v8.12.2",
"v8.12.1",
"v8.12.0",
"v8.11.2",
"v8.11.0",
"v8.11.1",
"v8.9.0",
"v8.8.0",
"v8.7.1",
"v8.7.0",
"v8.6.0",
"v8.5.0",
"v8.4.0",
"v8.3.0",
"v8.2.0",
"v8.1.0",
"v8.0.4",
"v8.0.3",
"v8.0.2",
"v8.0.1",
"v8.0.0",
"v5.5.1",
"v5.5.0",
"v4.1.0",
"v4.0.0",
"v4.0.0-BETA4",
"v4.0.0-BETA3",
"v4.0.0-BETA2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48019.json"
}
}
],
"modified": "2026-10-28T02:30:39.309448973Z",
"provider": "osv",
"references": [
"https://github.com/laravel/framework/releases/tag/v12.60.0",
"https://github.com/laravel/framework/releases/tag/v13.10.0",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48019.json",
"https://github.com/laravel/framework/security/advisories/GHSA-5vg9-5847-vvmq",
"https://nvd.nist.gov/vuln/detail/CVE-2026-48019",
"https://github.com/laravel/framework/commit/96e9a663db657cf37ef26cd794fda8ff60eaa451",
"https://github.com/laravel/framework/commit/f336ba79e744257f84ebf0d096b0ebc62e8e1a4d",
"https://github.com/laravel/framework/pull/60151"
],
"provider_metadata": {
"cwe_ids": [
"CWE-93"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48019.json"
}
},
"related_cves": [
{
"value": "CVE-2026-48019",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 506610,
"published_at": "2026-09-04T22:11:40.811+00:00"
}