Vulnerability · Published Jun 23, 2026 · Assigned by PSF
CVE-2026-0864Configuration Injection via Carriage Return (\r) in write() method
Medium 4.1
In plain English
A medium-severity injection in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)4.1Medium
Exploit odds (30 days)0.1%top 97.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.21 | python3 | 3.12.14-r0 | ALPINE-CVE-2026-0864 |
| Alpine:v3.22 | python3 | 3.12.14-r0 | ALPINE-CVE-2026-0864 |
| Alpine:v3.23 | python3 | 3.12.14-r0 | ALPINE-CVE-2026-0864 |
| Alpine:v3.24 | python3 | 3.14.7-r0 | ALPINE-CVE-2026-0864 |
| Debian:12 | pypy3 | no fix listed | DEBIAN-CVE-2026-0864 |
| Debian:13 | pypy3 | no fix listed | DEBIAN-CVE-2026-0864 |
| Debian:14 | pypy3 | 8.0.0+dfsg-1 | DEBIAN-CVE-2026-0864 |
| Debian:12 | python3.11 | no fix listed | DEBIAN-CVE-2026-0864 |
| Debian:13 | python3.13 | 3.13.5-2+deb13u5 | DEBIAN-CVE-2026-0864 |
| Debian:14 | python3.14 | 3.14.7-1 | DEBIAN-CVE-2026-0864 |
| Ubuntu:22.04:LTS | python3.10 | no fix listed | UBUNTU-CVE-2026-0864 |
| Ubuntu:24.04:LTS | python3.12 | no fix listed | UBUNTU-CVE-2026-0864 |
| Ubuntu:25.10 | python3.13 | no fix listed | UBUNTU-CVE-2026-0864 |
| Ubuntu:25.10 | python3.14 | no fix listed | UBUNTU-CVE-2026-0864 |
| Ubuntu:26.04:LTS | python3.14 | no fix listed | UBUNTU-CVE-2026-0864 |
| Ubuntu:26.10 | python3.14 | no fix listed | UBUNTU-CVE-2026-0864 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Python Software Foundation | CPython | 0 – before 3.10.213.11.0 – before 3.11.163.12.0 – before 3.12.143.13.0 – before 3.13.153.14.0 – before 3.14.73.15.0a1 – before 3.15.0b4 |
Weakness: CWE-74 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/python/cpython/pull/151559 patch
- https://mail.python.org/archives/list/security-announce@python.org/thread/CV4NE6AFCRJL7XQOHX7J5TSDHUWVWGJS/ vendor-advisory
- https://github.com/python/cpython/issues/143927 issue-tracking
- https://github.com/python/cpython/commit/5858e42c539dac8394636a6e9b30472b8994851f patch
- https://github.com/python/cpython/commit/0adb386f6e68eb2e73d32e19f235d012df009528 patch
- https://github.com/python/cpython/commit/71f2e02a52d47417a6fd69f456346cd8aa7aca98 patch
- https://github.com/python/cpython/commit/aaf850fd333cd89e9aada03d92aaa788a6cb1bb8 patch
- https://github.com/python/cpython/commit/db4a157c790479710a1a840d7937c5c815a6f8b6 patch
- https://github.com/python/cpython/commit/12dcbd74d3563016a8cb8c47e4898889f34f74dd patch
- https://github.com/python/cpython/commit/274de100bbf4345bd0c23ef5b446722e9e636908 patch