Vulnerability · Published Jan 20, 2026 · Assigned by PSF
CVE-2025-11468Folding email comments of unfoldable characters doesn't preserve parenthesis
Medium 5.7
In plain English
A medium-severity security flaw in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)5.7Medium
Exploit odds (30 days)0.6%top 50.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | pypy3 | no fix listed | DEBIAN-CVE-2025-11468 |
| Debian:13 | pypy3 | no fix listed | DEBIAN-CVE-2025-11468 |
| Debian:14 | pypy3 | 7.3.21+dfsg-1 | DEBIAN-CVE-2025-11468 |
| Debian:12 | python3.11 | 3.11.2-6+deb12u7 | DEBIAN-CVE-2025-11468 |
| Debian:13 | python3.13 | 3.13.5-2+deb13u1 | DEBIAN-CVE-2025-11468 |
| Debian:14 | python3.14 | 3.14.3-1 | DEBIAN-CVE-2025-11468 |
| Ubuntu:22.04:LTS | python3.10 | 3.10.12-1~22.04.14 | UBUNTU-CVE-2025-11468 |
| Ubuntu:24.04:LTS | python3.12 | 3.12.3-1ubuntu0.11 | UBUNTU-CVE-2025-11468 |
| Ubuntu:25.10 | python3.13 | 3.13.7-1ubuntu0.3 | UBUNTU-CVE-2025-11468 |
| Ubuntu:25.10 | python3.14 | 3.14.0-1ubuntu0.2 | UBUNTU-CVE-2025-11468 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Python Software Foundation | CPython | 0 – before 3.10.203.11.0 – before 3.11.153.12.0 – before 3.12.133.13.0 – before 3.13.123.14.0 – before 3.14.33.15.0a1 – before 3.15.0a6 |
Weakness: CWE-93 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/python/cpython/pull/143936 patch
- https://github.com/python/cpython/issues/143935 issue-tracking
- https://mail.python.org/archives/list/security-announce@python.org/thread/FELSEOLBI2QR6YLG6Q7VYF7FWSGQTKLI/ vendor-advisory
- https://github.com/python/cpython/commit/17d1490aa97bd6b98a42b1a9b324ead84e7fd8a2 patch
- https://github.com/python/cpython/commit/61614a5e5056e4f61ced65008d4576f3df34acb6 patch
- https://github.com/python/cpython/commit/e9970f077240c7c670e8a6fc6662f2b30d3b6ad0 patch
- https://github.com/python/cpython/commit/f738386838021c762efea6c9802c82de65e87796 patch
- https://github.com/python/cpython/commit/a76e4cd62dd68e7cbe86e37e6ed988495a646b66 patch
- https://github.com/python/cpython/commit/003b8315669b9f08b1010a49071f73f15f818094 patch