zbateson mail‑mime‑parser versions prior to 3.0.9 and 4.x before 4.0.6 contain a CRLF header injection flaw in the message‑building helpers. The library does not strip carriage‑return and line‑feed characters from MIME type, charset, encoding, micalg, or protocol values, enabling an attacker who can influence these parameters to inject additional header lines into outgoing messages. By forging header fields such as Bcc, an attacker could spoof recipients, redirect message flows, or facilitate spam and phishing campaigns. The weakness maps to CWE‑93.

The vulnerability affects the zbateson mail‑mime‑parser package on all platforms where the affected PHP code runs. Versions earlier than 3.0.9 and all 4.x releases prior to 4.0.6 are impacted. No specific operating systems or platforms are singled out, so any environment using these versions is at risk.

The CVSS score is 6.9, indicating a medium severity risk. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply crafted MIME header values to the application that uses the library; therefore, the attack vector is primarily an application‑layer input path. Successful exploitation would allow header forging and potential email spoofing or phishing, but does not provide remote code execution or broader system compromise. Nonetheless, the implications for confidentiality and integrity of email communications warrant prompt attention.