CVE-2025-11468
Unknown Unknown - Not Provided
Email Header Injection via Comment Folding Flaw in Python

Publication date: 2026-01-20

Last updated on: 2026-03-03

Assigner: Python Software Foundation

Description
When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-20
Last Modified
2026-03-03
Generated
2026-06-16
AI Q&A
2026-01-21
EPSS Evaluated
2026-06-15
NVD
CVE-2025-11468
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
python cpython 3.11
python cpython 3.12
python cpython 3.13
python cpython 3.14
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

To mitigate CVE-2025-11468, you should update your Python installations to versions where the fix has been applied, specifically Python versions 3.11, 3.12, 3.13, 3.14, or later. The fix corrects the email module's comment folding logic to prevent header injection attacks. If you are using Python 3.10 or earlier, monitor for backports or patches addressing this issue. Additionally, ensure that any user-controlled email addresses or inputs are properly sanitized to reduce risk. [1, 2, 3]

Executive Summary

This vulnerability occurs when folding a long comment in an email header that contains only unfoldable characters, causing the parenthesis to not be preserved. This flaw can be exploited to inject headers into email messages if the email addresses are user-controlled and not properly sanitized.

Impact Analysis

The vulnerability can allow an attacker to inject malicious headers into email messages, potentially leading to email spoofing, phishing, or other email-based attacks if user-controlled addresses are not sanitized.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-11468. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart