Folding email comments of unfoldable characters doesn't preserve parenthesis
Published Jan 20, 2026
5.7
MEDIUMCVSS 4.0
EPSS 0.63%
Description
When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.
Affected products
-
- Version 0StatusaffectedConstraints<3.10.20
- Version 3.11.0StatusaffectedConstraints<3.11.15
- Version 3.12.0StatusaffectedConstraints<3.12.13
- Version 3.13.0StatusaffectedConstraints<3.13.12
- Version 3.14.0StatusaffectedConstraints<3.14.3
- Version 3.15.0a1StatusaffectedConstraints<3.15.0a6
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Python Software Foundation | CPython | unaffected |
|
No data.
No data.
Red Hat Hardened Images
python3-11-main-3.11.15-4.hum1
Fixed · RHSA-2026:8822
Red Hat Hardened Images
python3-12-main-3.12.13-3.hum1
Fixed · RHSA-2026:8824
Red Hat Hardened Images
python3-13-main-3.13.13-1.hum1
Fixed · RHSA-2026:7443
Red Hat Hardened Images
python3-14-main-3.14.4-1.hum1
Fixed · RHSA-2026:7661
Red Hat Enterprise Linux 10
firefox
Fix deferred
Red Hat Enterprise Linux 10
python3.12
Fix deferred
Red Hat Enterprise Linux 10
python3.14
Fix deferred
Red Hat Enterprise Linux 6
python
Fix deferred
Red Hat Enterprise Linux 7
firefox
Fix deferred
Red Hat Enterprise Linux 7
python
Fix deferred
Red Hat Enterprise Linux 7
python3
Fix deferred
Red Hat Enterprise Linux 8
firefox
Fix deferred
Red Hat Enterprise Linux 8
python3
Fix deferred
Red Hat Enterprise Linux 8
python3.11
Fix deferred
Red Hat Enterprise Linux 8
python3.12
Fix deferred
Red Hat Enterprise Linux 8
python36:3.6/python36
Fix deferred
Red Hat Enterprise Linux 8
python39-devel:3.9/python39
Fix deferred
Red Hat Enterprise Linux 9
firefox
Fix deferred
Red Hat Enterprise Linux 9
python3.11
Fix deferred
Red Hat Enterprise Linux 9
python3.12
Fix deferred
Red Hat Enterprise Linux 9
python3.14
Fix deferred
Red Hat Enterprise Linux 9
python3.9
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3
rhelai3/bootc-aws-cuda-rhel9
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3
rhelai3/bootc-azure-cuda-rhel9
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3
rhelai3/bootc-cuda-rhel9
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3
rhelai3/bootc-gcp-cuda-rhel9
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Hardened Images | python3-11-main-3.11.15-4.hum1 | Fixed | RHSA-2026:8822 |
| Red Hat Hardened Images | python3-12-main-3.12.13-3.hum1 | Fixed | RHSA-2026:8824 |
| Red Hat Hardened Images | python3-13-main-3.13.13-1.hum1 | Fixed | RHSA-2026:7443 |
| Red Hat Hardened Images | python3-14-main-3.14.4-1.hum1 | Fixed | RHSA-2026:7661 |
| Red Hat Enterprise Linux 10 | firefox | Fix deferred | n/a |
| Red Hat Enterprise Linux 10 | python3.12 | Fix deferred | n/a |
| Red Hat Enterprise Linux 10 | python3.14 | Fix deferred | n/a |
| Red Hat Enterprise Linux 6 | python | Fix deferred | n/a |
| Red Hat Enterprise Linux 7 | firefox | Fix deferred | n/a |
| Red Hat Enterprise Linux 7 | python | Fix deferred | n/a |
| Red Hat Enterprise Linux 7 | python3 | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | firefox | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | python3 | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | python3.11 | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | python3.12 | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | python36:3.6/python36 | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | python39-devel:3.9/python39 | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | firefox | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | python3.11 | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | python3.12 | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | python3.14 | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | python3.9 | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-aws-cuda-rhel9 | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-azure-cuda-rhel9 | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-cuda-rhel9 | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-gcp-cuda-rhel9 | Fix deferred | n/a |
No package ranges for this CVE.
Remediation
Red Hat mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
References (14)
- https://access.redhat.com/security/cve/CVE-2025-11468 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2431375 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-206306 Advisory
- https://github.com/python/cpython/commit/003b8315669b9f08b1010a49071f73f15f818094 patch
- https://github.com/python/cpython/commit/17d1490aa97bd6b98a42b1a9b324ead84e7fd8a2 patch
- https://github.com/python/cpython/commit/61614a5e5056e4f61ced65008d4576f3df34acb6 patch
- https://github.com/python/cpython/commit/a76e4cd62dd68e7cbe86e37e6ed988495a646b66 patch
- https://github.com/python/cpython/commit/e9970f077240c7c670e8a6fc6662f2b30d3b6ad0 patch
- https://github.com/python/cpython/commit/f738386838021c762efea6c9802c82de65e87796 patch
- https://github.com/python/cpython/issues/143935 issue-tracking
- https://github.com/python/cpython/pull/143936 patch
- https://mail.python.org/archives/list/security-announce@python.org/thread/FELSEOLBI2QR6YLG6Q7VYF7FWSGQTKLI/ vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-11468
- https://www.cve.org/CVERecord?id=CVE-2025-11468
Change history (0)
No recorded changes yet.