This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-77634 →
UBUNTU-CVE-2026-77634
CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom...
Original description
The description as published by the source.
CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Ubuntu:16.04:LTS
cakephp
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:20.04:LTS
cakephp
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:22.04:LTS
cakephp
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
References
- report ubuntu.com
- report cve.org