CVE-2026-1299: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-1299 is a CRLF injection (header injection) vulnerability in Python's email module, specifically in the BytesGenerator class. The class failed to properly quote newlines in email headers during serialization, allowing an attacker to inject arbitrary headers into email messages. This issue is specifically triggered when using LiteralHeader to write headers that do not respect email folding rules. The vulnerability was disclosed on January 23, 2026, and has a CVSS v4.0 base score of 6.0 (Medium), as assigned by the Python Software Foundation (Python PSF, NVD). Affected products include IBM CICS Transaction Gateway for Multiplatforms, IBM Cloud Pak for Data System, and all Python versions prior to the patched releases across branches 3.10–3.14 (IBM Advisory).

The root cause is classified as CWE-93 (Improper Neutralization of CRLF Sequences / CRLF Injection). The BytesGenerator class in Python's email.generator module lacked the same header-safety validation that was previously added to the string-based Generator class (via GH-122233). Specifically, when serializing email messages using BytesGenerator._write_headers(), the code called policy.fold_binary(h, v) and wrote the result directly without checking for embedded newlines that could break header boundaries. The fix adds a NEWLINE_WITHOUT_FWSP_BYTES regex check and raises a HeaderWriteError if a folded header contains an unsafe newline sequence. Exploitation requires an attacker to control email content that is serialized through BytesGenerator using a LiteralHeader that bypasses normal folding rules (CPython PR #144126, CPython Commit).

An attacker with the ability to supply email content processed by the vulnerable BytesGenerator class can inject arbitrary email headers, potentially manipulating fields such as From, To, Cc, Bcc, Reply-To, or Subject. This could enable phishing attacks, email spoofing, spam relay abuse, or bypassing of email security controls. The integrity impact is rated High (VI:H) while confidentiality impact is Low (VC:L) and availability impact is None, reflecting the primary risk of data manipulation rather than system compromise (Feedly, NVD).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of this report (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. Exploitation requires an attacker to have low-level privileges and the ability to influence email content that is serialized through the affected code path, with specific attack requirements (AT:P) present (NVD).

1. Identify a target application: Find a Python-based application that uses email.BytesGenerator (e.g., via message.as_bytes()) to serialize email messages, particularly one that accepts user-controlled input for email headers.
2. Craft a malicious header value: Create a LiteralHeader subclass or supply input that embeds a CRLF sequence (e.g., \r\n) within a header value, such as Subject: Legitimate\r\nBcc: attacker@evil.com.
3. Trigger serialization: Cause the application to serialize the crafted email message using BytesGenerator, which will write the injected header without sanitization on unpatched Python versions.
4. Achieve header injection: The resulting serialized email will contain the injected header (e.g., Bcc: attacker@evil.com), which downstream mail transfer agents (MTAs) will interpret as a legitimate header, enabling spoofing, blind carbon copy injection, or other email manipulation (CPython Issue #144125, CPython PR #144126).

The Python Software Foundation released patches for all actively maintained branches: Python 3.10, 3.11, 3.12, 3.13, and 3.14, with the fix merged on January 23, 2026 (CPython Commit). The fix causes BytesGenerator to raise a HeaderWriteError when a header contains an unsafe newline sequence, mirroring protections already present in the string Generator class. IBM has released patches for CICS Transaction Gateway for Multiplatforms and IBM Cloud Pak for Data System (IBM Advisory). As a workaround, avoid using LiteralHeader with user-controlled content, and ensure all email header values are validated and sanitized before serialization. Upgrade to a patched Python version or apply the relevant OS/vendor security updates (available for Debian, Red Hat, SUSE, Fedora, Amazon Linux, and others).

The vulnerability was reported and fixed by Python Security Researcher Seth Michael Larson (sethmlarson), who noted it as a follow-up to the related CVE-2024-6923 affecting the string-based Generator class (CPython PR #144126). The fix was announced via the Python security mailing list and received broad distribution through Linux security advisories across major distributions including Red Hat, SUSE, Debian, Fedora, Oracle Linux, Rocky Linux, and AlmaLinux. Community reaction has been measured, with the vulnerability recognized as a completeness fix rather than a novel attack vector, given the prior CVE-2024-6923 addressed the same class of issue in the string generator (Python Security Announce).