PSF-2026-8

UNKNOWN

The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serializ

Published Jan 23, 2026

Modified 3 weeks ago

Fix available

Details

The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in "BytesGenerator".

Affected Packages

Python

Windows 10 (1507)Windows 10 (1607) / Server 2016Windows 10 (1809) / Server 2019Windows 10 (1903)Windows 10 (1909)

Fixed in:

3.10.203.11.153.12.133.13.123.14.33.15.0a6

References

WEB

https://cve.org/CVERecord?id=CVE-2024-6923

FIX

https://github.com/python/cpython/commit/052e55e7d44718fe46cbba0ca995cb8fcc359413

FIX

https://github.com/python/cpython/commit/0a925ab591c45d6638f37b5e57796f36fa0e56d8