CVE-2025-15366: 
Rocky Linux vulnerability analysis and mitigation

CVE-2025-15366 is an IMAP command injection vulnerability in Python's imaplib standard library module. When user-controlled input is passed as an IMAP command argument, an attacker can inject additional IMAP commands by embedding newline characters (\r\n) in the input. The vulnerability affects CPython versions prior to 3.15.0 and was disclosed on January 20, 2026, with the fix merged on the same day (CPython Issue, CPython PR). It carries a CVSS v4.0 base score of 5.9 (Medium), though Red Hat classifies it as Medium severity (Red Hat Bugzilla).

The root cause is improper neutralization of special elements (CWE-77: Command Injection) in Python's imaplib module. The _command() method in Lib/imaplib.py did not validate or sanitize command arguments before sending them to the IMAP server, allowing newline characters (\x0D\x0A) to be used as command delimiters to inject arbitrary additional IMAP commands. The fix adds a compiled regex pattern _control_chars = re.compile(b'[\x00-\x1F\x7F]') that checks each argument before transmission and raises a ValueError if any C0 control characters are detected (CPython Commit). Exploitation requires the attacker to control input passed to imaplib functions (e.g., login(), select()) and that the application does not independently sanitize such input before use (CPython PR).

Successful exploitation allows an attacker to inject and execute arbitrary IMAP protocol commands against the target mail server, potentially leading to unauthorized access to or modification of email data, including reading, deleting, or moving messages across mailboxes. The integrity impact is rated HIGH (VI:H) while confidentiality impact is LOW (VC:L) and availability impact is NONE, reflecting the primary risk of unauthorized mailbox manipulation. The scope is limited to the vulnerable system's IMAP session and does not extend to the broader network infrastructure (Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-15366. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.043%, indicating a very low probability of exploitation in the near term (Feedly). Exploitation requires an attacker to control input passed to the imaplib module, which limits the attack surface to applications that accept user-supplied data and pass it directly to IMAP commands without sanitization.

1. Identify a vulnerable target: Find a Python application (version < 3.15.0) that uses imaplib and passes user-controlled input (e.g., username, folder name, or search query) directly to IMAP commands such as login(), select(), or search().
2. Craft a malicious payload: Construct an input string containing a newline sequence (\r\n) followed by an additional IMAP command. For example, a username field could be crafted as: user\r\nA002 SELECT INBOX\r\n.
3. Submit the payload: Provide the crafted input through the application's interface (e.g., a login form, folder selection field, or search box) that feeds into the imaplib function call.
4. Achieve command injection: The imaplib module appends the unsanitized argument to the IMAP command stream, causing the injected newline to terminate the current command and the injected text to be interpreted as a new IMAP command by the server.
5. Execute arbitrary IMAP operations: The injected command executes in the context of the authenticated IMAP session, potentially allowing the attacker to read, delete, move, or otherwise manipulate email data (CPython Commit, CPython Issue).

• Network: Unexpected or malformed IMAP protocol traffic containing embedded \r\n sequences within command arguments; IMAP sessions issuing an unusually high number of commands or commands not consistent with normal application behavior.
• Logs: Application logs showing ValueError: Control characters not allowed in commands exceptions (on patched systems detecting attempted exploitation); IMAP server logs showing unexpected command sequences from a single authenticated session.
• Application Behavior: Unexpected IMAP operations (e.g., folder deletions, message moves, or flag changes) not initiated by legitimate users; errors or anomalies in mail client behavior correlated with user-supplied input fields.

The primary remediation is to upgrade CPython to version 3.15.0 or later, which includes the fix that rejects any IMAP command argument containing C0 control characters (bytes \x00–\x1F and \x7F) (CPython PR). For Linux distributions, patched packages have been released for Red Hat Enterprise Linux (RHSA-2026:2128 and subsequent advisories), Ubuntu (USN-8018-1, USN-8018-2, USN-8018-3), Debian (DLA-4455-1), Fedora, openSUSE, AlmaLinux, Rocky Linux, and Oracle Linux (Red Hat Bugzilla). As a workaround for applications that cannot be immediately patched, developers should sanitize all user-controlled input by stripping or rejecting control characters before passing them to any imaplib function.

The fix was authored by Seth Michael Larson (Python Security Developer-in-Residence) and merged into CPython main on January 20, 2026, with backports planned for supported release branches (CPython PR). The Python Software Foundation announced the issue via the security-announce mailing list. Multiple Linux distributions responded promptly with security advisories and patched packages within weeks of disclosure. No significant controversy or notable social media discussion beyond routine security advisory coverage has been observed.