Back to Security Advisories

Swift Mailer Vulnerability — Ubuntu Security Update (USN-8986-1)

USN-8986-1 fixes CVE-2016-10074 in Swift Mailer on Ubuntu: improper sanitization of email addresses in the mail transport lets a remote attacker pass extra parameters to the mail command — the classic email header injection that can hijack outgoing mail (CVSS 9.8, CWE-77 command injection). Update: sudo apt update && sudo apt upgrade and restart applications using Swift Mailer.

Critical 9.8 CVSS
Ubuntu 20.04 Ubuntu 22.04

What this means under a SharedLicense license

Header injection in a mail library means attacker-controlled input can add recipients, rewrite messages or execute mail-command parameters — turning contact forms and password-mailers into spam and phishing cannons.

  1. Ubuntu Security Notices

  2. USN-8986-1

Publication date

3 November 2026

Overview

Swift Mailer could be made to run programs if it received specially crafted
input.

Releases


16.04 LTS

Open side navigation

Packages

Details

Dawid Golunski discovered that Swift Mailer did not properly sanitize
e-mail addresses in the mail transport. A remote attacker could possibly
use this issue to pass extra parameters to the mail command and execute
arbitrary code.

Dawid Golunski discovered that Swift Mailer did not properly sanitize
e-mail addresses in the mail transport. A remote attacker could possibly
use this issue to pass extra parameters to the mail command and execute
arbitrary code.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
16.04

LTS xenial

 php-swiftmailer – 

5.4.1-1ubuntu1+esm1

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Frequently Asked Questions

What is CVE-2016-10074?
It is an email header injection flaw in Swift Mailer's mail transport: improperly sanitized email addresses let a remote attacker pass extra parameters to the underlying mail command. CVSS 9.8 (CWE-77 command injection); fixed in USN-8986-1.
Who is affected?
Applications using the Swift Mailer library to send mail with user-supplied addresses — contact forms, notification senders and older PHP applications. Ubuntu ships the fix through the updated package.
How do I apply the fix?
Run sudo apt update && sudo apt upgrade (the swiftmailer package) and restart the PHP applications using it so they load the patched library.
What does email header injection enable?
Injected parameters can add hidden recipients (spam relay), rewrite message bodies (phishing) or pass arbitrary arguments to the mail command — turning a contact form into an attacker-controlled mail sender.

References

Security Advisories

Related Advisories

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Linux Kernel (Low Latency NVIDIA) Vulnerabilities — Ubuntu Security Update (USN-9040-1)

2026-11-11

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System