CVE-2026-1299

MEDIUM

CPython email module - CRLF Injection in BytesGenerator Header Serialization

Title source: llm
STIX 2.1

Description

The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in "BytesGenerator".

References (10)

Core 10
Core References
Issue Tracking issue-tracking
https://github.com/python/cpython/issues/144125

Scores

CVSS v4 6.0
EPSS 0.0056
EPSS Percentile 42.0%
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-93
Status published
Published Jan 23, 2026
Tracked Since Feb 18, 2026