CVE-2026-77634

Summary

CakePHP: SmtpTransport vulnerable to CRLF header injection

Severity

high

EPSS

0.3% (p24)

CWE

CWE-93

Also known as

GHSA-2qh5-382h-3jpc

Published

2026-09-08

Updated

2026-09-08

Advisory details

Impact

Custom mail headers added with Message::setHeaders() or addHeaders() do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes.

Patches

5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes for this issue.

Workarounds

You can strip CRLF bytes from email header values before setting header values.

References

• https://github.com/advisories/GHSA-2qh5-382h-3jpc
• https://github.com/cakephp/cakephp/security/advisories/GHSA-2qh5-382h-3jpc
• https://nvd.nist.gov/vuln/detail/CVE-2026-77634
• https://github.com/cakephp/cakephp/commit/08188962bcd99a95da1e49f62e786f2d688f1e41
• https://github.com/cakephp/cakephp/commit/2afe42b02d8ddc5d442bca5e8bb61910a727646e
• https://github.com/cakephp/cakephp/commit/3e09dae6cbdc983754fa3a8e6aae74da102a3ea1
• https://github.com/cakephp/cakephp/commit/b67b622457362b075bb37e625a82af73a0b3c9c3

Related advisories

• CVE-2026-77635 — critical · Packagist/cakephp/cakephp
• CVE-2026-48820 — medium · Packagist/cakephp/cakephp
• CVE-2026-23643 — medium · Packagist/cakephp/cakephp
• CVE-2026-84372 — critical · Packagist/predis/predis
• CVE-2026-54511 — high · npm/@logtape/syslog
• GHSA-p77j-g7h5-r2vw — high · PyPI/geolens
• CVE-2026-84379 — medium · PyPI/httpx2
• CVE-2026-71311 — medium · Go/github.com/rclone/rclone

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity