8 CVEs in Cpython announced this week

[Alan Coopersmith <alan.coopersmith () oracle com>]

https://mail.python.org/archives/list/security-announce () python org/thread/FELSEOLBI2QR6YLG6Q7VYF7FWSGQTKLI/ 
announces:

> [CVE-2025-11468] Folding email comments of unfoldable characters doesn't preserve parenthesis
>
> There is a MEDIUM severity vulnerability affecting CPython.
>
> When folding a long comment in an email header containing exclusively
> unfoldable characters, the parenthesis would not be preserved. This could
> be used for injecting headers into email messages where addresses are
> user-controlled and not sanitized.
>
> Please see the linked CVE ID for the latest information on affected
> versions:
>
>     https://www.cve.org/CVERecord?id=CVE-2025-11468
>     https://github.com/python/cpython/pull/143936

https://www.cve.org/CVERecord?id=CVE-2025-11468 lists affected versions as
"affected from 0 before 3.15.0"

    ------------------------------------------------------------------------

https://mail.python.org/archives/list/security-announce () python org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/ 
announces:

> [CVE-2025-15366] IMAP command injection in user-controlled commands
>
> There is a MEDIUM severity vulnerability affecting CPython.
>
> The imaplib module, when passed a user-controlled command, can have
> additional commands injected using newlines. Mitigation rejects commands
> containing control characters.
>
> Please see the linked CVE ID for the latest information on affected
> versions:
>
>     https://www.cve.org/CVERecord?id=CVE-2025-15366
>     https://github.com/python/cpython/pull/143922

https://www.cve.org/CVERecord?id=CVE-2025-15366 lists affected versions as
"affected from 0 before 3.15.0"

    ------------------------------------------------------------------------

https://mail.python.org/archives/list/security-announce () python org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/ 
announces:

> [CVE-2025-15367] POP3 command injection in user-controlled commands
>
> There is a MEDIUM severity vulnerability affecting CPython.
>
> The poplib module, when passed a user-controlled command, can have
> additional commands injected using newlines. Mitigation rejects commands
> containing control characters.
>
> Please see the linked CVE ID for the latest information on affected
> versions:
>
>     https://www.cve.org/CVERecord?id=CVE-2025-15367
>     https://github.com/python/cpython/pull/143924

https://www.cve.org/CVERecord?id=CVE-2025-15367 lists affected versions as
"affected from 0 before 3.15.0"

    ------------------------------------------------------------------------

https://mail.python.org/archives/list/security-announce () python org/thread/X66HL7SISGJT33J53OHXMZT4DFLMHVKF/ 
announces:

> [CVE-2025-15282] Header injection via newlines in data URL mediatype
>
> There is a MEDIUM severity vulnerability affecting CPython.
>
> User-controlled data URLs parsed by urllib.request.DataHandler allow
> injecting headers through newlines in the data URL mediatype.
>
> Please see the linked CVE ID for the latest information on affected
> versions:
>
>     https://www.cve.org/CVERecord?id=CVE-2025-15282
>     https://github.com/python/cpython/pull/143926

https://www.cve.org/CVERecord?id=CVE-2025-15282 lists affected versions as
"affected from 0 before 3.15.0"

    ------------------------------------------------------------------------

https://mail.python.org/archives/list/security-announce () python org/thread/6VFLQQEIX673KXKFUZXCUNE5AZOGZ45M/ 
announces:

> [CVE-2026-0672] Header injection in http.cookies.Morsel
>
> There is a MEDIUM severity vulnerability affecting CPython.
>
> When using http.cookies.Morsel, user-controlled cookie values and
> parameters can allow injecting HTTP headers into messages. Patch rejects
> all control characters within cookie names, values, and parameters.
>
> Please see the linked CVE ID for the latest information on affected
> versions:
>
>     https://www.cve.org/CVERecord?id=CVE-2026-0672
>     https://github.com/python/cpython/pull/143920

https://www.cve.org/CVERecord?id=CVE-2026-0672 lists affected versions as
"affected from 0 before 3.15.0"

    ------------------------------------------------------------------------

https://mail.python.org/archives/list/security-announce () python org/thread/6ZZULGALJTITEAGEXLDJE2C6FORDXPBT/ 
announces:

> [CVE-2026-1299] email BytesGenerator header injection due to unquoted newlines
>
> There is a MEDIUM severity vulnerability affecting CPython.
>
> The email module, specifically the "BytesGenerator" class, didn’t properly
> quote newlines for email headers when
> serializing an email message allowing for header injection when an email is
> serialized. This is only applicable if using "LiteralHeader" while writing
> headers that don't respect email folding rules, the new behavior will
> reject the incorrectly folded headers in "BytesGenerator".
>
> Please see the linked CVE ID for the latest information on
> affected versions:
>
>     https://www.cve.org/CVERecord?id=CVE-2026-1299
>     https://github.com/python/cpython/pull/144126

https://www.cve.org/CVERecord?id=CVE-2026-1299 lists affected versions as
"affected from 0 before 3.15.0"

    ------------------------------------------------------------------------

https://mail.python.org/archives/list/security-announce () python org/thread/BJ6QPHNSHJTS3A7CFV6IBMCAP2DWRVNT/ 
announces:

> [CVE-2026-0865] wsgiref.headers.Headers allows header newline injection
>
> There is a MEDIUM severity vulnerability affecting CPython.
>
> User-controlled header names and values containing newlines can allow
> injecting HTTP headers.
>
> Please see the linked CVE ID for the latest information on affected
> versions:
>
> https://www.cve.org/CVERecord?id=CVE-2026-0865
> https://github.com/python/cpython/pull/143917

https://www.cve.org/CVERecord?id=CVE-2026-0865 lists affected versions as
"affected from 0 before 3.15.0"

    ------------------------------------------------------------------------

https://mail.python.org/archives/list/security-announce () python org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/ 
announces:

> [CVE-2025-12781] base64.b64decode() always accepts "+/" characters, despite setting altchars
>
> There is a MEDIUM severity vulnerability affecting CPython.
>
> When passing data to the b64decode(), standard_b64decode(), and
> urlsafe_b64decode() functions in the "base64" module the characters "+/"
> will always be accepted, regardless of the value of "altchars" parameter,
> typically used to establish an "alternative base64 alphabet" such as the
> URL safe alphabet. This behavior matches what is recommended in earlier
> base64 RFCs, but newer RFCs now recommend either dropping characters
> outside the specified base64 alphabet or raising an error. The old behavior
> has the possibility of causing data integrity issues.
>
> This behavior can only be insecure if your application uses an alternate
> base64 alphabet (without "+/"). If your application does not use the
> "altchars" parameter or the urlsafe_b64decode() function, then your
> application does not use an alternative base64 alphabet.
>
> The attached patches DO NOT make the base64-decode behavior raise an error,
> as this would be a change in behavior and break existing programs. Instead,
> the patch deprecates the behavior which will be replaced with the newly
> recommended behavior in a future version of Python. Users are recommended
> to mitigate by verifying user-controlled inputs match the base64
> alphabet they are expecting or verify that their application would not be
> affected if the b64decode() functions accepted "+" or "/" outside of
> altchars.
>
> Please see the linked CVE ID for the latest information on affected
> versions:
>
>     https://www.cve.org/CVERecord?id=CVE-2025-12781
>     https://github.com/python/cpython/pull/141128

https://www.cve.org/CVERecord?id=CVE-2025-12781 lists affected versions as
 * "affected from 0 before 3.13.10"
 * "affected from 3.14.0 before 3.14.1"
 * "affected from 3.15.0a1 before 3.15.0a2"

--
        -Alan Coopersmith-                 alan.coopersmith () oracle com
         Oracle Solaris Engineering - https://blogs.oracle.com/solaris