CVE-2026-1299: email BytesGenerator header injection due to unquoted newlines
Deferred
AliasesSUSE-SU-2026:0873-1SUSE-SU-2026:0884-1SUSE-SU-2026:0891-1SUSE-SU-2026:0897-1SUSE-SU-2026:1090-1UBUNTU-CVE-2026-1299DEBIAN-CVE-2026-1299CGA-3hhm-jg5q-r9v7CGA-c9h2-43g4-m56xCGA-cgx7-5h45-6xr5CGA-g7qh-49gg-64fvCGA-hw3w-x7mm-rxvxCGA-jhj2-w2wm-p9wvCGA-jw5h-r9qh-q2p4CGA-mg73-w7j6-v3ffCGA-w4qx-9m86-vcj4CGA-wmvg-v7p4-pwg6openSUSE-SU-2026:10398-1CGA-5fxp-2wrx-gm39CGA-r3wg-pfc9-xfpp
Published 23-01-2026Last modified 03-03-2026
Vulnerability summary
CVE-2026-1299 is a medium (CVSS 6.0) vulnerability in python software foundation cpython. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 47.4% of scored vulnerabilities.
Priority
Routine
Not severe (CVSS 6, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
6.0/10
010
Medium · v4.0 (CVE.org)EPSS score
0.57%
0%100%
Low · -0.01 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 45 · Related 18DLA-4455-1MGASA-2026-0455OPENSUSE-SU-2026:10206-1OPENSUSE-SU-2026:10222-1OPENSUSE-SU-2026:10223-1OPENSUSE-SU-2026:10404-1OPENSUSE-SU-2026:20254-1OPENSUSE-SU-2026:20517-1RHSA-2026:2128RHSA-2026:4165RHSA-2026:4168RHSA-2026:4216RHSA-2026:4463RHSA-2026:4473RHSA-2026:4713RHSA-2026:4746RHSA-2026:5152RHSA-2026:5215RHSA-2026:5216RHSA-2026:5218RHSA-2026:5219RHSA-2026:5221RHSA-2026:5223RHSA-2026:5225RHSA-2026:5226RHSA-2026:5315RHSA-2026:5399RHSA-2026:6008RHSA-2026:6253RHSA-2026:6464RHSA-2026:7443RHSA-2026:7661RHSA-2026:8822RHSA-2026:8824SUSE-SU-2026:0642-1SUSE-SU-2026:1117-1SUSE-SU-2026:1349-1SUSE-SU-2026:1354-1SUSE-SU-2026:20543-1SUSE-SU-2026:20581-1SUSE-SU-2026:20951-1SUSE-SU-2026:20956-1SUSE-SU-2026:21104-1SUSE-SU-2026:21178-1USN-8509-1CGA-PJGM-MFPH-CXR6
Timeline
- 23-01-2026PublishedVulnerability first disclosed.
- 03-03-2026Last modifiedVulnerability information updated.
Description
The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in "BytesGenerator".
CVSS metrics
6 scores · 6 sources · 1 versionMedium 6.0Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:NSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated6.0MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated6.0MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated6.0MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated6.0MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
- NVDNIST6.0MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.57%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
Decrease -0.01 pp
From 0.58% on 05-10-2026
05-10-202604-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Suse47 products
- python-base&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7< 2.7.18-150000.108.1
- python-base&distro=SUSE Linux Enterprise Server 12 SP5-LTSS< 2.7.18-33.69.1
- python-base&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5< 2.7.18-33.69.1
- python-doc&distro=SUSE Linux Enterprise Server 12 SP5-LTSS< 2.7.18-33.69.1
- python-doc&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5< 2.7.18-33.69.1
Ubuntu13 products
- pypy3All versions (No fix recorded)
- python2.7All versions (No fix recorded)
- python3.10< 3.10.12-1~22.04.16
- python3.11All versions (No fix recorded)
- python3.12< 3.12.3-1ubuntu0.15
Opensuse7 products
- python-base&distro=openSUSE Leap 15.6< 2.7.18-150000.108.1
- python-doc&distro=openSUSE Leap 15.6< 2.7.18-150000.108.1
- python3-core&distro=openSUSE Leap 15.6< 3.6.15-150300.10.109.1
- python3-documentation&distro=openSUSE Leap 15.6< 3.6.15-150300.10.109.1
- python311&distro=openSUSE Tumbleweed< 3.11.15-3.1
Chainguard6 products
- python-3.10< 3.10.19-r4
- python-3.11< 3.11.14-r6
- python-3.12< 3.12.12-r5
- python-3.13< 3.13.12-r1
- python-3.14< 3.14.3-r1
Wolfi5 products
- python-3.10< 3.10.19-r4
- python-3.11< 3.11.14-r6
- python-3.12< 3.12.12-r5
- python-3.13< 3.13.12-r1
- python-3.14< 3.14.3-r1
Debian4 products
- pypy3All versions (No fix recorded) | < 7.3.21+dfsg-1
- python3.11< 3.11.2-6+deb12u7
- python3.13< 3.13.12-1 | < 3.13.5-2+deb13u1
- python3.14< 3.14.3-1
Python software foundation1 product
- cpython< 3.10.20 | ≥ 3.11.0, < 3.11.15 | ≥ 3.12.0, < 3.12.13 | ≥ 3.13.0, < 3.13.12 | ≥ 3.14.0, < 3.14.3 | ≥ 3.15.0a1, < 3.15.0a6
7 vendors · 83 products
References
24 links- mail.python.org/archives/list/security-announce@python.org/thread/6ZZULGALJTITEAGEXLDJE2C6FORDXPBT/Vendor AdvisoryREPORTAdvisory
Show all 24 references
- github.com/python/cpythonPACKAGE