CVE-2025-15367: POP3 command injection in user-controlled commands
Deferred
AliasesRHSA-2026:5994UBUNTU-CVE-2025-15367DEBIAN-CVE-2025-15367CGA-3h86-qrh3-64w8CGA-5336-j8mr-r6g4CGA-8fx3-25f8-fh5xCGA-c39r-w42m-w4vjCGA-c5rh-xxpp-872rCGA-ch3p-52mr-p765CGA-cjx6-763w-4wfcCGA-ffmr-pm2v-8xqwCGA-fhp9-r9rg-wpv2CGA-h68m-5fcm-3cwxCGA-wx55-qrwh-xc7rCGA-xwgm-4f5v-v3xwCGA-cx2g-r55q-44rgCGA-v93h-6cpg-xvxg
Published 20-01-2026Last modified 26-02-2026
Vulnerability summary
CVE-2025-15367 is a medium (CVSS 5.9) vulnerability in python software foundation cpython. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 31.8% of scored vulnerabilities.
Priority
Routine
Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
5.9/10
010
Medium · v4.0 (CVE.org)EPSS score
0.38%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 51 · Related 25DLA-4455-1MGASA-2026-0455OPENSUSE-SU-2026:10152-1OPENSUSE-SU-2026:10200-1OPENSUSE-SU-2026:10206-1OPENSUSE-SU-2026:10221-1OPENSUSE-SU-2026:10222-1OPENSUSE-SU-2026:11342-1OPENSUSE-SU-2026:21595-1RHSA-2026:2128RHSA-2026:4165RHSA-2026:4168RHSA-2026:4216RHSA-2026:4463RHSA-2026:4473RHSA-2026:4713RHSA-2026:4746RHSA-2026:5152RHSA-2026:5215RHSA-2026:5216RHSA-2026:5218RHSA-2026:5219RHSA-2026:5221RHSA-2026:5223RHSA-2026:5225RHSA-2026:5226RHSA-2026:5315RHSA-2026:5393RHSA-2026:5399RHSA-2026:6007RHSA-2026:6008RHSA-2026:6253RHSA-2026:6464RHSA-2026:7443RHSA-2026:8822RHSA-2026:8824SUSE-SU-2026:0590-1SUSE-SU-2026:0612-1SUSE-SU-2026:0613-1SUSE-SU-2026:0643-1SUSE-SU-2026:0644-1SUSE-SU-2026:0645-1SUSE-SU-2026:0663-1SUSE-SU-2026:0664-1SUSE-SU-2026:0693-1SUSE-SU-2026:0767-1SUSE-SU-2026:20665-1SUSE-SU-2026:20710-1SUSE-SU-2026:23159-1SUSE-SU-2026:23303-1SUSE-SU-2026:3649-1CGA-V285-6RG6-MRF4USN-8018-1USN-8018-2
Timeline
- 20-01-2026PublishedVulnerability first disclosed.
- 26-02-2026Last modifiedVulnerability information updated.
Description
The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
CVSS metrics
7 scores · 7 sources · 2 versionsMedium 5.9Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:NSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated5.9MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated5.9MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
- NVDNIST5.9MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 7.1Preferred score · OSV · Red hat (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:NSourcesSingle source
EPSS trend
Probability
0.38%
Chance of exploitation in the next 30 days
Percentile
32%
Versus all other CVEs
30-day change
Increase +0.01 pp
From 0.37% on 05-10-2026
05-10-202604-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: network-reachable, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat16 products
- python-unversioned-command< 0:3.14.3-2.hum1
- python3< 0:3.14.3-2.hum1
- python3-debug< 0:3.14.3-2.hum1
- python3-devel< 0:3.14.3-2.hum1
- python3-idle< 0:3.14.3-2.hum1
Ubuntu12 products
- python2.7All versions (No fix recorded)
- python3.10All versions (No fix recorded)
- python3.11All versions (No fix recorded)
- python3.12All versions (No fix recorded)
- python3.13All versions (No fix recorded)
Chainguard7 products
- python-3.10All versions (No fix recorded)
- python-3.11All versions (No fix recorded)
- python-3.12All versions (No fix recorded) | < 3.12.16-r2
- python-3.13All versions (No fix recorded)
- python-3.14All versions (No fix recorded)
Wolfi6 products
- python-3.10All versions (No fix recorded)
- python-3.11All versions (No fix recorded)
- python-3.12All versions (No fix recorded) | < 3.12.16-r2
- python-3.13All versions (No fix recorded)
- python-3.14All versions (No fix recorded)
Debian5 products
- jythonAll versions (No fix recorded)
- pypy3All versions (No fix recorded)
- python3.11All versions (No fix recorded)
- python3.13All versions (No fix recorded)
- python3.14All versions (No fix recorded)
Python software foundation1 product
- cpython< 3.15.0a6
6 vendors · 47 products
References
19 links- mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/Vendor AdvisoryARTICLEREPORTAdvisory
- images.redhat.comARTICLE
Show all 19 references
- github.com/python/cpythonPACKAGE