What’s Vulnerable › Vulnerabilities

CVE-2026-1299: email BytesGenerator header injection due to unquoted newlines

• Severity: medium (CVSS 6.0 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-23 · updated 2026-06-17
• Weakness: CWE-93

Description

The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in "BytesGenerator".

Affected products

• Python: before 3.10.20; from 3.11.0 before 3.11.15; from 3.12.0 before 3.12.13; from 3.13.0 before 3.13.12; from 3.14.0 before 3.14.3; from 3.15.0a1 before 3.15.0a6 — fixed in 3.10.20, 3.11.15, 3.12.13, 3.13.12, 3.14.3, 3.15.0a6

How to fix

Upgrade to a fixed version: Python 3.10.20, 3.11.15, 3.12.13, 3.13.12. Check the vendor advisory for mitigations.

References

• https://cve.org/CVERecord?id=CVE-2024-6923
• https://github.com/python/cpython/commit/052e55e7d44718fe46cbba0ca995cb8fcc359413
• https://github.com/python/cpython/commit/0a925ab591c45d6638f37b5e57796f36fa0e56d8
• https://github.com/python/cpython/commit/7877fe424415bc4a13045e62a90a7277413d8cb9
• https://github.com/python/cpython/commit/842ce19a0c0b58d61591e8f6a708c38db1fb94e4
• https://github.com/python/cpython/commit/8cdf6204f4ae821f32993f8fc6bad0d318f95f36
• https://github.com/python/cpython/commit/e417f05ad77a4c30ddc07f99e90fc0cef43e831a
• https://github.com/python/cpython/issues/144125
• https://github.com/python/cpython/pull/144126
• https://mail.python.org/archives/list/security-announce@python.org/thread/6ZZULGALJTITEAGEXLDJE2C6FORDXPBT/

Get alerted when CVE-2026-1299 or the next vulnerability affects your stack