CVE-2026-1299
Gravedad CVSS v4.0:
MEDIA
Tipo:
CWE-93
Neutralización incorrecta de secuencias de retornos de carro y saltos de linea (CRLF)
Fecha de publicación:
23/01/2026
Última modificación:
13/02/2026
Descripción
*** Pendiente de traducción *** The <br />
email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when <br />
serializing an email message allowing for header injection when an email<br />
is serialized. This is only applicable if using "LiteralHeader" writing headers that don&#39;t respect email folding rules, the new behavior will reject the incorrectly folded headers in "BytesGenerator".
Impacto
Puntuación base 4.0
6.00
Gravedad 4.0
MEDIA
Referencias a soluciones, herramientas e información
- https://cve.org/CVERecord?id=CVE-2024-6923
- https://github.com/python/cpython/commit/052e55e7d44718fe46cbba0ca995cb8fcc359413
- https://github.com/python/cpython/commit/0a925ab591c45d6638f37b5e57796f36fa0e56d8
- https://github.com/python/cpython/commit/7877fe424415bc4a13045e62a90a7277413d8cb9
- https://github.com/python/cpython/commit/842ce19a0c0b58d61591e8f6a708c38db1fb94e4
- https://github.com/python/cpython/commit/8cdf6204f4ae821f32993f8fc6bad0d318f95f36
- https://github.com/python/cpython/commit/e417f05ad77a4c30ddc07f99e90fc0cef43e831a
- https://github.com/python/cpython/issues/144125
- https://github.com/python/cpython/pull/144126
- https://mail.python.org/archives/list/security-announce@python.org/thread/6ZZULGALJTITEAGEXLDJE2C6FORDXPBT/