CVE-2025-11468
Email Header Injection via Comment Folding Flaw in Python
Publication date: 2026-01-20
Last updated on: 2026-03-03
Assigner: Python Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| python | cpython | 3.11 |
| python | cpython | 3.12 |
| python | cpython | 3.13 |
| python | cpython | 3.14 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-93 | The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs when folding a long comment in an email header that contains only unfoldable characters, causing the parenthesis to not be preserved. This flaw can be exploited to inject headers into email messages if the email addresses are user-controlled and not properly sanitized.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to inject malicious headers into email messages, potentially leading to email spoofing, phishing, or other email-based attacks if user-controlled addresses are not sanitized.
What immediate steps should I take to mitigate this vulnerability?
To mitigate CVE-2025-11468, you should update your Python installations to versions where the fix has been applied, specifically Python versions 3.11, 3.12, 3.13, 3.14, or later. The fix corrects the email module's comment folding logic to prevent header injection attacks. If you are using Python 3.10 or earlier, monitor for backports or patches addressing this issue. Additionally, ensure that any user-controlled email addresses or inputs are properly sanitized to reduce risk. [1, 2, 3]