Vulnerability · Published Jan 23, 2026 · Assigned by PSF
CVE-2026-1299email BytesGenerator header injection due to unquoted newlines
Medium 6.0
In plain English
A medium-severity security flaw in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)6.0Medium
Exploit odds (30 days)0.6%top 52.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in "BytesGenerator".
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | platform-python | 3.6.8-73.el8_10.alma.1 | ALSA-2026:2128 |
| AlmaLinux:8 | platform-python-debug | 3.6.8-73.el8_10.alma.1 | ALSA-2026:2128 |
| AlmaLinux:8 | platform-python-devel | 3.6.8-73.el8_10.alma.1 | ALSA-2026:2128 |
| AlmaLinux:10 | python-unversioned-command | 3.12.12-3.el10_1.1 | ALSA-2026:4713 |
| AlmaLinux:9 | python-unversioned-command | 3.9.25-3.el9_7.1 | ALSA-2026:4168 |
| AlmaLinux:9 | python3 | 3.9.25-3.el9_7.1 | ALSA-2026:4168 |
| AlmaLinux:9 | python3-debug | 3.9.25-3.el9_7.1 | ALSA-2026:4168 |
| AlmaLinux:9 | python3-devel | 3.9.25-3.el9_7.1 | ALSA-2026:4168 |
| AlmaLinux:8 | python3-idle | 3.6.8-73.el8_10.alma.1 | ALSA-2026:2128 |
| AlmaLinux:9 | python3-idle | 3.9.25-3.el9_7.1 | ALSA-2026:4168 |
| AlmaLinux:8 | python3-libs | 3.6.8-73.el8_10.alma.1 | ALSA-2026:2128 |
| AlmaLinux:9 | python3-libs | 3.9.25-3.el9_7.1 | ALSA-2026:4168 |
| AlmaLinux:8 | python3-test | 3.6.8-73.el8_10.alma.1 | ALSA-2026:2128 |
| AlmaLinux:9 | python3-test | 3.9.25-3.el9_7.1 | ALSA-2026:4168 |
| AlmaLinux:8 | python3-tkinter | 3.6.8-73.el8_10.alma.1 | ALSA-2026:2128 |
| AlmaLinux:9 | python3-tkinter | 3.9.25-3.el9_7.1 | ALSA-2026:4168 |
| AlmaLinux:8 | python3.11 | 3.11.13-5.el8_10 | ALSA-2026:4473 |
| AlmaLinux:9 | python3.11 | 3.11.13-5.1.el9_7 | ALSA-2026:4216 |
| AlmaLinux:8 | python3.11-debug | 3.11.13-5.el8_10 | ALSA-2026:4473 |
| AlmaLinux:9 | python3.11-debug | 3.11.13-5.1.el9_7 | ALSA-2026:4216 |
| AlmaLinux:8 | python3.11-devel | 3.11.13-5.el8_10 | ALSA-2026:4473 |
| AlmaLinux:9 | python3.11-devel | 3.11.13-5.1.el9_7 | ALSA-2026:4216 |
| AlmaLinux:8 | python3.11-idle | 3.11.13-5.el8_10 | ALSA-2026:4473 |
| AlmaLinux:9 | python3.11-idle | 3.11.13-5.1.el9_7 | ALSA-2026:4216 |
| AlmaLinux:8 | python3.11-libs | 3.11.13-5.el8_10 | ALSA-2026:4473 |
| AlmaLinux:9 | python3.11-libs | 3.11.13-5.1.el9_7 | ALSA-2026:4216 |
| AlmaLinux:8 | python3.11-rpm-macros | 3.11.13-5.el8_10 | ALSA-2026:4473 |
| AlmaLinux:8 | python3.11-test | 3.11.13-5.el8_10 | ALSA-2026:4473 |
| AlmaLinux:9 | python3.11-test | 3.11.13-5.1.el9_7 | ALSA-2026:4216 |
| AlmaLinux:8 | python3.11-tkinter | 3.11.13-5.el8_10 | ALSA-2026:4473 |
| AlmaLinux:9 | python3.11-tkinter | 3.11.13-5.1.el9_7 | ALSA-2026:4216 |
| AlmaLinux:8 | python3.12 | 3.12.12-3.el8_10 | ALSA-2026:4463 |
| AlmaLinux:9 | python3.12 | 3.12.12-4.el9_7.1 | ALSA-2026:4165 |
| AlmaLinux:8 | python3.12-debug | 3.12.12-3.el8_10 | ALSA-2026:4463 |
| AlmaLinux:9 | python3.12-debug | 3.12.12-4.el9_7.1 | ALSA-2026:4165 |
| AlmaLinux:8 | python3.12-devel | 3.12.12-3.el8_10 | ALSA-2026:4463 |
| AlmaLinux:9 | python3.12-devel | 3.12.12-4.el9_7.1 | ALSA-2026:4165 |
| AlmaLinux:8 | python3.12-idle | 3.12.12-3.el8_10 | ALSA-2026:4463 |
| AlmaLinux:9 | python3.12-idle | 3.12.12-4.el9_7.1 | ALSA-2026:4165 |
| AlmaLinux:8 | python3.12-libs | 3.12.12-3.el8_10 | ALSA-2026:4463 |
| AlmaLinux:9 | python3.12-libs | 3.12.12-4.el9_7.1 | ALSA-2026:4165 |
| AlmaLinux:8 | python3.12-rpm-macros | 3.12.12-3.el8_10 | ALSA-2026:4463 |
| AlmaLinux:8 | python3.12-test | 3.12.12-3.el8_10 | ALSA-2026:4463 |
| AlmaLinux:9 | python3.12-test | 3.12.12-4.el9_7.1 | ALSA-2026:4165 |
| AlmaLinux:8 | python3.12-tkinter | 3.12.12-3.el8_10 | ALSA-2026:4463 |
| AlmaLinux:9 | python3.12-tkinter | 3.12.12-4.el9_7.1 | ALSA-2026:4165 |
| Debian:12 | pypy3 | no fix listed | DEBIAN-CVE-2026-1299 |
| Debian:13 | pypy3 | no fix listed | DEBIAN-CVE-2026-1299 |
| Debian:14 | pypy3 | 7.3.21+dfsg-1 | DEBIAN-CVE-2026-1299 |
| Debian:12 | python3.11 | 3.11.2-6+deb12u7 | DEBIAN-CVE-2026-1299 |
| Debian:13 | python3.13 | 3.13.5-2+deb13u1 | DEBIAN-CVE-2026-1299 |
| Debian:14 | python3.14 | 3.14.3-1 | DEBIAN-CVE-2026-1299 |
| Rocky Linux:8 | python3 | 0:3.6.8-73.el8_10.rocky.0 | RLSA-2026:2128 |
| Rocky Linux:8 | python3.11 | 0:3.11.13-5.el8_10 | RLSA-2026:4473 |
| Rocky Linux:9 | python3.11 | 0:3.11.13-5.1.el9_7 | RLSA-2026:4216 |
| Rocky Linux:10 | python3.12 | 0:3.12.12-3.el10_1.1 | RLSA-2026:4713 |
| Rocky Linux:8 | python3.12 | 0:3.12.12-3.el8_10 | RLSA-2026:4463 |
| Rocky Linux:9 | python3.12 | 0:3.12.12-4.el9_7.1 | RLSA-2026:4165 |
| Rocky Linux:9 | python3.9 | 0:3.9.25-3.el9_7.1 | RLSA-2026:4168 |
| Ubuntu:22.04:LTS | pypy3 | no fix listed | UBUNTU-CVE-2026-1299 |
| Ubuntu:24.04:LTS | pypy3 | no fix listed | UBUNTU-CVE-2026-1299 |
| Ubuntu:25.10 | pypy3 | no fix listed | UBUNTU-CVE-2026-1299 |
| Ubuntu:26.04:LTS | pypy3 | no fix listed | UBUNTU-CVE-2026-1299 |
| Ubuntu:26.10 | pypy3 | no fix listed | UBUNTU-CVE-2026-1299 |
| Ubuntu:22.04:LTS | python3.10 | 3.10.12-1~22.04.16 | UBUNTU-CVE-2026-1299 |
| Ubuntu:22.04:LTS | python3.10 | 3.10.12-1~22.04.16 | USN-8509-1 |
| Ubuntu:24.04:LTS | python3.12 | 3.12.3-1ubuntu0.15 | UBUNTU-CVE-2026-1299 |
| Ubuntu:24.04:LTS | python3.12 | 3.12.3-1ubuntu0.15 | USN-8509-1 |
| Ubuntu:25.10 | python3.13 | no fix listed | UBUNTU-CVE-2026-1299 |
| Ubuntu:25.10 | python3.14 | no fix listed | UBUNTU-CVE-2026-1299 |
| Ubuntu:26.04:LTS | python3.14 | 3.14.3-1 | UBUNTU-CVE-2026-1299 |
| Ubuntu:26.04:LTS | python3.14 | 3.14.4-1ubuntu0.1 | USN-8509-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Python Software Foundation | CPython | 0 – before 3.10.203.11.0 – before 3.11.153.12.0 – before 3.12.133.13.0 – before 3.13.123.14.0 – before 3.14.33.15.0a1 – before 3.15.0a6 |
Weakness: CWE-93 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/python/cpython/pull/144126 patch
- https://github.com/python/cpython/issues/144125 issue-tracking
- https://cve.org/CVERecord?id=CVE-2024-6923 related
- https://mail.python.org/archives/list/security-announce@python.org/thread/6ZZULGALJTITEAGEXLDJE2C6FORDXPBT/ vendor-advisory
- https://github.com/python/cpython/commit/052e55e7d44718fe46cbba0ca995cb8fcc359413 patch
- https://github.com/python/cpython/commit/0a925ab591c45d6638f37b5e57796f36fa0e56d8 patch
- https://github.com/python/cpython/commit/7877fe424415bc4a13045e62a90a7277413d8cb9 patch
- https://github.com/python/cpython/commit/842ce19a0c0b58d61591e8f6a708c38db1fb94e4 patch
- https://github.com/python/cpython/commit/8cdf6204f4ae821f32993f8fc6bad0d318f95f36 patch
- https://github.com/python/cpython/commit/e417f05ad77a4c30ddc07f99e90fc0cef43e831a patch