CVE-2025-11468

Folding email comments of unfoldable characters doesn't preserve parenthesis

Severity Score

5.7

*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.

Denis Ledoux discovered that Python incorrectly parsed email message headers. An attacker could possibly use this issue to inject arbitrary headers into email messages. This issue only affected python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12, python3.13, and python3.14 packages. Jacob Walls, Shai Berger, and Natalia Bidart discovered that Python inefficiently parsed XML input with quadratic complexity. An attacker could possibly use this issue to cause a denial of service.

*Credits: Denis Ledoux, Seth Larson, Denis Ledoux, R. David Murray

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

High

User Interaction

Passive

System

Vulnerable | Subsequent

Confidentiality

None

Integrity

High

None

Availability

None

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2025-10-07 CVE Reserved
2026-01-20 CVE Published
2026-03-03 CVE Updated
2026-03-29 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')

CAPEC

References (9)

URL	Tag	Source
https://github.com/python/cpython/issues/143935	Issue Tracking

URL	Date	SRC

URL	Date	SRC
https://github.com/python/cpython/commit/17d1490aa97bd6b98a42b1a9b324ead84e7fd8a2	2026-01-20
https://github.com/python/cpython/pull/143936	2026-01-20
https://github.com/python/cpython/commit/61614a5e5056e4f61ced65008d4576f3df34acb6	2026-03-03
https://github.com/python/cpython/commit/e9970f077240c7c670e8a6fc6662f2b30d3b6ad0	2026-03-03
https://github.com/python/cpython/commit/f738386838021c762efea6c9802c82de65e87796	2026-03-03
https://github.com/python/cpython/commit/a76e4cd62dd68e7cbe86e37e6ed988495a646b66	2026-03-03
https://github.com/python/cpython/commit/003b8315669b9f08b1010a49071f73f15f818094	2026-03-03

URL	Date	SRC
https://mail.python.org/archives/list/security-announce@python.org/thread/FELSEOLBI2QR6YLG6Q7VYF7FWSGQTKLI	2026-01-20

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Python Software Foundation Search vendor "Python Software Foundation"		CPython Search vendor "Python Software Foundation" for product "CPython"				< 3.10.20 Search vendor "Python Software Foundation" for product "CPython" and version " < 3.10.20"		en		Affected
Python Software Foundation Search vendor "Python Software Foundation"		CPython Search vendor "Python Software Foundation" for product "CPython"				>= 3.11.0 < 3.11.15 Search vendor "Python Software Foundation" for product "CPython" and version " >= 3.11.0 < 3.11.15"		en		Affected
Python Software Foundation Search vendor "Python Software Foundation"		CPython Search vendor "Python Software Foundation" for product "CPython"				>= 3.12.0 < 3.12.13 Search vendor "Python Software Foundation" for product "CPython" and version " >= 3.12.0 < 3.12.13"		en		Affected
Python Software Foundation Search vendor "Python Software Foundation"		CPython Search vendor "Python Software Foundation" for product "CPython"				>= 3.13.0 < 3.13.12 Search vendor "Python Software Foundation" for product "CPython" and version " >= 3.13.0 < 3.13.12"		en		Affected
Python Software Foundation Search vendor "Python Software Foundation"		CPython Search vendor "Python Software Foundation" for product "CPython"				>= 3.14.0 < 3.14.3 Search vendor "Python Software Foundation" for product "CPython" and version " >= 3.14.0 < 3.14.3"		en		Affected