CVE-2025-15367: 
Rocky Linux vulnerability analysis and mitigation

CVE-2025-15367 is a POP3 command injection vulnerability in Python's poplib standard library module. When user-controlled input is passed to POP3 commands, additional commands can be injected via embedded newline characters, as the module failed to reject control characters. The vulnerability affects CPython versions before 3.15.0 and was disclosed on January 20, 2026. It carries a CVSS v4.0 base score of 5.9 (Medium), though Feedly estimates the severity as HIGH (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper neutralization of special elements in a command (CWE-77 / Command Injection). Python's poplib module did not validate or sanitize user-supplied input before passing it to POP3 protocol commands, allowing an attacker to embed newline characters (\r\n) or other C0 control characters (bytes \x00–\x1F and \x7F) to terminate one command and inject additional arbitrary POP3 commands. The fix, applied in commit b234a2b, adds a regex check in _putcmd() that raises a ValueError if any control character is detected in the command string before it is sent to the server (CPython PR #143924, CPython Commit). Exploitation requires the attacker to control input passed to poplib functions such as user() or pass_(), and requires network access and high privileges (e.g., the ability to influence the application's POP3 credentials or commands) (Red Hat Bugzilla).

Successful exploitation allows an attacker to inject arbitrary POP3 commands into a session established by a vulnerable Python application. This can result in bypassing authentication mechanisms, intercepting or manipulating email communications, and exfiltrating sensitive email data from the POP3 server. The CVSS v4.0 assessment reflects high integrity impact and low confidentiality impact, with no availability impact; downstream systems relying on the affected POP3 session may also be affected (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.043%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an attacker to control input passed to poplib commands, which limits the attack surface to applications that pass untrusted user data directly to POP3 operations (Red Hat Advisory, CPython Issue #143923).

1. Identify a vulnerable target: Find a Python application (using CPython < 3.15.0) that uses the poplib module and passes user-controlled input (e.g., username or password fields) directly to POP3 commands such as user() or pass_().
2. Craft a malicious payload: Construct an input string containing an embedded newline sequence (e.g., \r\n) followed by an additional POP3 command, such as validuser\r\nDELE 1 to inject a DELE command after the USER command.
3. Submit the payload: Provide the crafted string as the username or password in the application's POP3 authentication flow, causing the poplib module to transmit both the original and injected commands to the POP3 server.
4. Achieve command injection: The POP3 server processes the injected command as a legitimate protocol command, potentially allowing the attacker to delete messages, retrieve emails, or manipulate mailbox state without proper authorization (CPython PR #143924, CPython Commit).

• Network: Unexpected or malformed POP3 protocol traffic containing multiple commands in a single TCP segment; POP3 sessions with commands containing embedded \r\n sequences or other control characters.
• Logs: Application logs showing ValueError: Control characters not allowed in commands (on patched systems detecting attempted exploitation); POP3 server logs showing unexpected command sequences (e.g., DELE, RETR, or NOOP commands appearing immediately after USER or PASS commands in the same session).
• Application Behavior: Unusual mailbox state changes (e.g., unexpected message deletions or retrievals) correlated with user authentication events in applications using poplib.

The fix is included in CPython 3.15.0 and has been backported to distributions via vendor security updates. Red Hat has issued multiple errata addressing this vulnerability across RHEL 6 through 10 (e.g., RHSA-2026:2128 for RHEL 8, RHSA-2026:4165 for RHEL 9, RHSA-2026:4713 for RHEL 10). Debian, Ubuntu (USN-8018-1, USN-8018-2, USN-8018-3), openSUSE, Fedora, AlmaLinux, Rocky Linux, and Oracle Linux have also released patched packages. IBM has addressed the issue in CICS Transaction Gateway for Multiplatforms and Cloud Pak for Data System. As a workaround, applications should validate and sanitize all user-controlled input before passing it to poplib functions, explicitly rejecting any input containing control characters (Red Hat Bugzilla, Ubuntu USN-8018-1, IBM Advisory).

The Python Security Response Team (PSF) disclosed the vulnerability via the security-announce@python.org mailing list. During the pull request review, Python core developers raised backward compatibility concerns, noting that some users may have passwords containing tab or backspace characters that would be rejected by the new validation; as a result, the fix was initially not backported to older stable branches. The vulnerability received broad coverage across Linux distribution security advisories (Red Hat, Debian, Ubuntu, SUSE, Fedora, Oracle, Rocky, AlmaLinux) and was tracked by multiple vulnerability scanners including Nessus and Qualys (CPython PR #143924, Red Hat Bugzilla).