What’s Vulnerable › Vulnerabilities

CVE-2025-1795: Mishandling of comma during folding and unicode-encoding of email headers

• Severity: low (CVSS 2.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-02-28 · updated 2026-07-31
• Weakness: CWE-116

Description

During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers.

Affected products

• Python: before 3.9.23; from 3.10.0 before 3.10.17; from 3.11.0 before 3.11.9; from 3.12.0 before 3.12.3; from 3.13.0a1 before 3.13.0a5 — fixed in 3.10.17, 3.11.9, 3.12.3, 3.13.0a5, 3.9.23

How to fix

Upgrade to a fixed version: Python 3.10.17, 3.11.9, 3.12.3, 3.13.0a5. Check the vendor advisory for mitigations.

References

• https://github.com/python/cpython/commit/09fab93c3d857496c0bd162797fab816c311ee48
• https://github.com/python/cpython/commit/70754d21c288535e86070ca7a6e90dcb670b8593
• https://github.com/python/cpython/commit/9148b77e0af91cdacaa7fe3dfac09635c3fe9a74
• https://github.com/python/cpython/commit/a4ef689ce670684ec132204b1cd03720c8e0a03d
• https://github.com/python/cpython/commit/d4df3c55e4c5513947f907f24766b34d2ae8c090
• https://github.com/python/cpython/issues/100884
• https://github.com/python/cpython/pull/100885
• https://github.com/python/cpython/pull/119099
• https://mail.python.org/archives/list/security-announce@python.org/thread/MB62IZMEC3UM6SGHP5LET5JX2Y7H4ZUR/
• https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html

Get alerted when CVE-2025-1795 or the next vulnerability affects your stack