CVE-2025-11468: 
Python Interpreter vulnerability analysis and mitigation

CVE-2025-11468 is an email header injection vulnerability in CPython's email standard library module, specifically in the comment folding logic used when flattening email messages with a modern email policy. When folding a long comment in an email header that contains exclusively unfoldable characters, the parentheses delimiting the comment are not preserved, causing the remainder of the comment to be interpreted as a new header field. This flaw can be exploited to inject arbitrary headers into email messages where addresses are user-controlled and not sanitized. It affects CPython versions prior to 3.15.0 (including 3.10, 3.11, 3.12, 3.13, and 3.14 branches) and carries a CVSS v4.0 base score of 5.7 (Medium) (CPython Issue, CPython PR).

The root cause is improper neutralization of CRLF sequences (CWE-93) in the _refold_parse_tree function within Lib/email/_header_value_parser.py. When the folding algorithm encounters a comment token consisting of a very long sequence of non-foldable characters, it performs a forced line wrap but omits the required leading whitespace (folding white space, FWS) on the continuation line and fails to preserve the enclosing parentheses. Per RFC 5322, a line that does not begin with whitespace is interpreted as a new header field, so the content after the forced wrap is treated as an injected header. Exploitation requires that the attacker control an email address field (e.g., a To: or From: comment) that is passed unsanitized to Python's email library using a modern policy, and that the comment be long enough to trigger the forced fold (CPython Commit, CPython PR).

Successful exploitation allows an attacker to inject arbitrary email headers (e.g., Bcc:, Content-Type:, Subject:) into outgoing messages processed by the vulnerable Python email library. This can enable email spoofing, phishing campaigns, spam relay abuse, and potential bypass of email security filters that rely on header integrity. The impact is limited to integrity (no confidentiality or availability impact), and exploitation requires the attacker to have some degree of control over user-supplied address data passed to the library without sanitization (CPython Issue, Feedly).

1. Identify a target application: Find a Python web application or service that uses CPython's email library with a modern email policy to send emails, where user-supplied input (e.g., a display name or comment in an address field) is passed without sanitization.
2. Craft a malicious comment payload: Construct an email address comment containing a very long sequence of non-foldable characters (no spaces or foldable points) that exceeds the line length limit (default 78 characters), followed by a CRLF and the desired injected header, e.g.: (AAAA...AAAA[long unfoldable string]\r\nBcc: victim@example.com).
3. Submit the payload: Provide the crafted address (including the malicious comment) as user-controlled input to the application (e.g., a "From" display name or address comment field in a contact form or API).
4. Trigger email sending: Cause the application to send an email using the tainted address, invoking the vulnerable _refold_parse_tree folding logic.
5. Header injection achieved: The folding algorithm drops the closing parenthesis and leading whitespace, causing the injected content to be interpreted as a new header field by the receiving mail server, enabling Bcc injection, spoofing, or other header manipulation (CPython Commit, CPython PR).

• Logs: Outgoing email logs showing unexpected headers (e.g., Bcc:, Cc:, Subject:) that were not set by the application; SMTP server logs with anomalous header counts or unexpected recipients.
• Network: Emails delivered to recipients not specified by the application logic; unusual SMTP traffic patterns with crafted To: or From: fields containing long comment strings.
• Application: User-supplied input fields containing very long strings of non-whitespace characters enclosed in parentheses, particularly in address or display name fields; application errors related to email header parsing or folding.

The Python Software Foundation has released patches for all affected branches. Fixed commits are available for CPython 3.10 (commit 003b831), 3.11, 3.12, 3.13, 3.14, and the main (3.15) branch (commit 17d1490). Downstream distributions including Debian, Ubuntu (USN-8018-1, USN-8018-2, USN-8018-3), SUSE, Fedora, openSUSE, and Amazon Linux have released updated packages. The recommended remediation is to upgrade to a patched Python version as provided by your distribution. As a workaround, applications should sanitize all user-controlled input before passing it to the email library, rejecting or stripping parentheses and CRLF sequences from address fields (CPython PR, Debian Advisory, Ubuntu Advisory).

The vulnerability was discovered and reported by Seth Michael Larson (Python Security Response Team) and Denis Ledoux, with the fix merged into CPython on January 19, 2026. The Python Software Foundation announced the issue via the security-announce mailing list. Downstream Linux distributions responded promptly with security advisories and package updates across Debian, Ubuntu, SUSE, Fedora, and Amazon Linux. No significant broader media coverage or notable social media discussion beyond standard security advisory channels has been observed (Python Security Announce, oss-sec).