What’s Vulnerable › Vulnerabilities

CVE-2025-15367: POP3 command injection in user-controlled commands

• Severity: medium (CVSS 5.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-20 · updated 2026-06-17
• Weakness: CWE-77

Description

The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

Affected products

• Python: before 3.15.0a6 — fixed in 3.15.0a6

How to fix

Upgrade to a fixed version: Python 3.15.0a6. Check the vendor advisory for mitigations.

References

• https://github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7
• https://github.com/python/cpython/issues/143923
• https://github.com/python/cpython/pull/143924
• https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/

Get alerted when CVE-2025-15367 or the next vulnerability affects your stack