CVE-2026-1299

Aliases:UBUNTU-CVE-2026-1299DEBIAN-CVE-2026-1299CGA-3hhm-jg5q-r9v7CGA-c9h2-43g4-m56xCGA-cgx7-5h45-6xr5CGA-g7qh-49gg-64fvCGA-hw3w-x7mm-rxvxCGA-jhj2-w2wm-p9wvCGA-jw5h-r9qh-q2p4CGA-mg73-w7j6-v3ffCGA-5fxp-2wrx-gm39CGA-r3wg-pfc9-xfppCGA-w4qx-9m86-vcj4CGA-wmvg-v7p4-pwg6
Advisory lineage Upstream: 0 Downstream: 51
Deferred
Published: 23 Jan 2026, 16:27
Last modified:03 Mar 2026, 14:43

Vulnerability Summary

Overall Risk (default)
low
24/100
CVSS Score
6 MEDIUM
v4.0 (cve.org)
EPSS Score
0.54% LOW
1% probability +0.50%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

23 Jan 2026, 16:27
Published
Vulnerability first disclosed
03 Mar 2026, 14:43
Last Modified
Vulnerability information updated

Description

The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in "BytesGenerator".

CVSS Metrics

  • v4.0•MEDIUM•Score: 6CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
  • v4.0•MEDIUM•Score: 6CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Trends

Current EPSS score: 0.54%• Percentile: 45%

Techniques & Countermeasures

  • CWE-93•Improper Neutralization of CRLF Sequences ('CRLF Injection')

    The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Affected Systems

  • chainguard•python-3.10

    < 3.10.19-r4

  • chainguard•python-3.11

    < 3.11.14-r6

  • chainguard•python-3.12

    < 3.12.12-r5

  • chainguard•python-3.13

    < 3.13.12-r1

  • chainguard•python-3.14

    < 3.14.3-r1

  • chainguard•python-3.9

    all

  • wolfi•python-3.10

    < 3.10.19-r4

  • wolfi•python-3.11

    < 3.11.14-r6

  • wolfi•python-3.12

    < 3.12.12-r5

  • wolfi•python-3.13

    < 3.13.12-r1

  • wolfi•python-3.14

    < 3.14.3-r1

  • debian•pypy3

    all | all | all | < 7.3.21+dfsg-1

  • debian•python3.11

    < 3.11.2-6+deb12u7

  • debian•python3.13

    < 3.13.5-2+deb13u1 | < 3.13.12-1

  • debian•python3.14

    < 3.14.3-1

  • debian•python3.9

    < 3.9.2-1+deb11u5

  • ubuntu•pypy3

    all | all | all | all | all

  • ubuntu•python2.7

    all

  • ubuntu•python3.10

    < 3.10.12-1~22.04.16

  • ubuntu•python3.11

    all | all

  • ubuntu•python3.12

    < 3.12.3-1ubuntu0.15

  • ubuntu•python3.13

    all

  • ubuntu•python3.14

    all | < 3.14.3-1

  • ubuntu•python3.4

    all

  • ubuntu•python3.5

    all

  • ubuntu•python3.6

    all

  • ubuntu•python3.7

    all

  • ubuntu•python3.8

    all

  • ubuntu•python3.9

    all

  • python software foundation•cpython

    < 3.15.0 | ≥ 3.15.0a1, < 3.15.0 | < 3.13.12 | < 3.10.20 | ≥ 3.11.0, < 3.11.15 | ≥ 3.12.0, < 3.12.13 | ≥ 3.13.0, < 3.13.12 | ≥ 3.14.0, < 3.14.3 | ≥ 3.15.0a1, < 3.15.0a6

References (17)