Email Header Injection via Comment Folding Flaw in Python

Publication date: 2026-01-20

Last updated on: 2026-03-03

Assigner: Python Software Foundation

Description

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-20

Last Modified

2026-03-03

Generated

2026-07-06

AI Q&A

2026-01-21

EPSS Evaluated

2026-07-05

NVD

CVE-2025-11468

Affected Vendors & Products

Vendor	Product	Version / Range
python	cpython	3.11
python	cpython	3.12
python	cpython	3.13
python	cpython	3.14

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Mitigation Strategies

To mitigate CVE-2025-11468, you should update your Python installations to versions where the fix has been applied, specifically Python versions 3.11, 3.12, 3.13, 3.14, or later. The fix corrects the email module's comment folding logic to prevent header injection attacks. If you are using Python 3.10 or earlier, monitor for backports or patches addressing this issue. Additionally, ensure that any user-controlled email addresses or inputs are properly sanitized to reduce risk. [1, 2, 3]

Executive Summary

This vulnerability occurs when folding a long comment in an email header that contains only unfoldable characters, causing the parenthesis to not be preserved. This flaw can be exploited to inject headers into email messages if the email addresses are user-controlled and not properly sanitized.

Impact Analysis

The vulnerability can allow an attacker to inject malicious headers into email messages, potentially leading to email spoofing, phishing, or other email-based attacks if user-controlled addresses are not sanitized.

Hi! I’m here to help you understand CVE-2025-11468. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70