Repository navigation
CVE-2026-1299: debian package python3.13-minimal-3.13.5-2 #353
Description
Title
cpython: email header injection due to unquoted newlines
Description
The
email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when
serializing an email message allowing for header injection when an email
is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in "BytesGenerator".
Severity
HIGH
Fixed in Version
No known fix at this time
Primary URL
https://avd.aquasec.com/nvd/cve-2026-1299
Additional Information
Vulnerability ID: CVE-2026-1299}
Package Name: python3.13-minimal
Package Version: 3.13.5-2
References
- https://access.redhat.com/errata/RHSA-2026:4165
- https://access.redhat.com/security/cve/CVE-2026-1299
- https://bugzilla.redhat.com/2431368
- https://bugzilla.redhat.com/2431373
- https://bugzilla.redhat.com/2432437
- https://bugzilla.redhat.com/show_bug.cgi?id=2431367
- https://bugzilla.redhat.com/show_bug.cgi?id=2431368
- https://bugzilla.redhat.com/show_bug.cgi?id=2431373
- https://bugzilla.redhat.com/show_bug.cgi?id=2432437
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15366
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15367
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0865
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1299
- https://cve.org/CVERecord?id=CVE-2024-6923
- https://errata.almalinux.org/9/ALSA-2026-4165.html
- https://errata.rockylinux.org/RLSA-2026:4168
- python/cpython@052e55e
- python/cpython@0a925ab
- python/cpython@7877fe4
- python/cpython@842ce19
- python/cpython@8cdf620
- python/cpython@e417f05
- Encode newlines in headers when using ByteGenerator python/cpython#144125
- gh-144125: email: verify headers are sound in BytesGenerator python/cpython#144126
- https://linux.oracle.com/cve/CVE-2026-1299.html
- https://linux.oracle.com/errata/ELSA-2026-4473.html
- https://mail.python.org/archives/list/security-announce@python.org/thread/6ZZULGALJTITEAGEXLDJE2C6FORDXPBT/
- https://nvd.nist.gov/vuln/detail/CVE-2026-1299
- https://www.cve.org/CVERecord?id=CVE-2026-1299
Activity