Skip to content
OpenAdvisories

Description

The
email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when
serializing an email message allowing for header injection when an email
is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in "BytesGenerator".

Affected products

VendorProductAffectedFixed
Python Software Foundation CPython < 3.10.20, 3.11.0 – < 3.11.15, 3.12.0 – < 3.12.13, 3.13.0 – < 3.13.12, 3.14.0 – < 3.14.3, 3.15.0a1 – < 3.15.0a6 3.10.20

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 pypy3 7.3.21+dfsg-1 —
Debian 14 python3.14 3.14.3-1 —
Debian 13 pypy3 No fix yet —
Debian 13 python3.13 3.13.5-2+deb13u1 —
Debian 12 pypy3 No fix yet —
Debian 12 python3.11 3.11.2-6+deb12u7 —
Debian 11 python3.9 3.9.2-1+deb11u5 DLA-4455-1
ReleasePackageFixed inAdvisory
Ubuntu 26.10 pypy3 No fix yet —
Ubuntu 26.04 LTS pypy3 No fix yet —
Ubuntu 26.04 LTS python3.14 3.14.3-1 USN-8509-1
Ubuntu 25.10 pypy3 +2 No fix yet —
Ubuntu 24.04 LTS pypy3 No fix yet —
Ubuntu 24.04 LTS python3.12 3.12.3-1ubuntu0.15 USN-8509-1
Ubuntu 22.04 LTS pypy3 No fix yet —
Ubuntu 22.04 LTS python3.10 3.10.12-1~22.04.16 USN-8509-1
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS pypy3 No fix yet —
Ubuntu Pro 22.04 LTS python2.7 +1 No fix yet —
Ubuntu Pro 20.04 LTS python2.7 +2 No fix yet —
Ubuntu Pro 18.04 LTS python2.7 +3 No fix yet —
Ubuntu Pro 16.04 LTS python2.7 +1 No fix yet —
Ubuntu Pro 14.04 LTS python2.7 +2 No fix yet —
ReleasePackageFixed inAdvisory
RHEL 10 python3 +8 3.12.12-3.el10_1.1 RHSA-2026:4713
RHEL 9 python3 +8 3.9.25-3.el9_7.1 RHSA-2026:4168
RHEL 9 python3.11 +6 3.11.13-5.1.el9_7 RHSA-2026:4216
RHEL 9 python3.12 +6 3.12.12-4.el9_7.1 RHSA-2026:4165
RHEL 8 python3 +7 3.6.8-73.el8_10 RHSA-2026:2128
RHEL 8 python3.11 +7 3.11.13-5.el8_10 RHSA-2026:4473
RHEL 8 python3.12 +7 3.12.12-3.el8_10 RHSA-2026:4463
Show 15 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS python3 +8 3.12.9-2.el10_0.7 RHSA-2026:5315
RHEL 9.6 EUS python3 +8 3.9.21-2.el9_6.4 RHSA-2026:5218
RHEL 9.6 EUS python3.12 +6 3.12.9-1.el9_6.6 RHSA-2026:4746
RHEL 9.4 EUS python3 +8 3.9.18-3.el9_4.11 RHSA-2026:5226
RHEL 9.4 EUS python3.11 +6 3.11.7-1.el9_4.11 RHSA-2026:6253
RHEL 9.4 EUS python3.12 +6 3.12.1-4.el9_4.11 RHSA-2026:5399
RHEL 9.2 E4S python3 +5 3.9.16-1.el9_2.12 RHSA-2026:5225
RHEL 9.2 E4S python3.11 +3 3.11.2-2.el9_2.10 RHSA-2026:5223
RHEL 9.0 E4S python3 +5 3.9.10-4.el9_0.9 RHSA-2026:5219
RHEL 8.8 TUS python3 +7 3.6.8-51.el8_8.13 RHSA-2026:6008
RHEL 8.8 TUS python3.11 +4 3.11.2-2.el8_8.8 RHSA-2026:5152
RHEL 8.8 E4S python3 +7 3.6.8-51.el8_8.13 RHSA-2026:6008
RHEL 8.8 E4S python3.11 +4 3.11.2-2.el8_8.8 RHSA-2026:5152
RHEL 8.6 TUS python3 +7 3.6.8-47.el8_6.11 RHSA-2026:5215
RHEL 8.6 E4S python3 +7 3.6.8-47.el8_6.11 RHSA-2026:5215
RHEL 8.6 AUS python3 +7 3.6.8-47.el8_6.11 RHSA-2026:5215
RHEL 8.4 EUS Long Life python3 +7 3.6.8-39.el8_4.9 RHSA-2026:5221
RHEL 8.4 AUS python3 +7 3.6.8-39.el8_4.9 RHSA-2026:5221
RHEL 8.2 AUS python3 +7 3.6.8-24.el8_2.6 RHSA-2026:5216
RHEL 7 ELS python3 +6 3.6.8-21.el7_9.4 RHSA-2026:6464
Red Hat Hardened Images 1 python3 +15 3.14.4-1.hum1 RHSA-2026:7661
Red Hat Hardened Images 1 python3.11 +6 3.11.15-4.hum1 RHSA-2026:8822
Red Hat Hardened Images 1 python3.12 +6 3.12.13-3.hum1 RHSA-2026:8824
Red Hat Hardened Images 1 python3.13 +8 3.13.13-1.hum1 RHSA-2026:7443

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 python-unversioned-command 3.12.12-3.el10_1.1 ALSA-2026:4713
AlmaLinux 9 python3 +7 3.9.25-3.el9_7.1 ALSA-2026:4168
AlmaLinux 9 python3.11 +6 3.11.13-5.1.el9_7 ALSA-2026:4216
AlmaLinux 9 python3.12 +6 3.12.12-4.el9_7.1 ALSA-2026:4165
AlmaLinux 8 python3-idle +6 3.6.8-73.el8_10.alma.1 ALSA-2026:2128
AlmaLinux 8 python3.11 +7 3.11.13-5.el8_10 ALSA-2026:4473
AlmaLinux 8 python3.12 +7 3.12.12-3.el8_10 ALSA-2026:4463

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 python3.12 3.12.12-3.el10_1.1 RLSA-2026:4713
Rocky Linux 9 python3.11 3.11.13-5.1.el9_7 RLSA-2026:4216
Rocky Linux 9 python3.12 3.12.12-4.el9_7.1 RLSA-2026:4165
Rocky Linux 9 python3.9 3.9.25-3.el9_7.1 RLSA-2026:4168
Rocky Linux 8 python3 3.6.8-73.el8_10.rocky.0 RLSA-2026:2128
Rocky Linux 8 python3.11 3.11.13-5.el8_10 RLSA-2026:4473
Rocky Linux 8 python3.12 3.12.12-3.el8_10 RLSA-2026:4463
ReleasePackageFixed inAdvisory
SLES 15 SP7 python +1 2.7.18-150000.108.1 SUSE-SU-2026:0873-1
SLES 15 SP7 python3 +1 3.6.15-150300.10.109.1 SUSE-SU-2026:1090-1
SLES 15 SP7 python311-core 3.11.15-150600.3.53.1 SUSE-SU-2026:1349-1
SLES 15 SP6 python3 +1 3.6.15-150300.10.109.1 SUSE-SU-2026:1090-1
SLES 15 SP6 python311 +1 3.11.15-150600.3.53.1 SUSE-SU-2026:1349-1
SLES 15 SP5 python3 +1 3.6.15-150300.10.109.1 SUSE-SU-2026:1090-1
SLES 15 SP5 python311 +2 3.11.15-150400.9.80.1 SUSE-SU-2026:1117-1
SLES 15 SP4 python3 +1 3.6.15-150300.10.109.1 SUSE-SU-2026:1090-1
SLES 15 SP4 python311 +2 3.11.15-150400.9.80.1 SUSE-SU-2026:1117-1
SLES 12 SP5 python +2 2.7.18-33.69.1 SUSE-SU-2026:0891-1
SLES 12 SP5 python3 +1 3.4.10-25.175.1 SUSE-SU-2026:0897-1
SLES 12 SP5 python36 +1 3.6.15-103.1 SUSE-SU-2026:0884-1
Show 15 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 3 python311 +1 3.11.15-150600.3.53.1 SUSE-SU-2026:1349-1
SLES 3 python313 +1 3.13.12-150700.4.39.1 SUSE-SU-2026:1354-1, SUSE-SU-2026:0642-1
SLES for SAP 16.0 python313 +2 3.13.12-160000.1.1 SUSE-SU-2026:21178-1, SUSE-SU-2026:20581-1
SLES for SAP 15 SP6 python3 +1 3.6.15-150300.10.109.1 SUSE-SU-2026:1090-1
SLES for SAP 15 SP6 python311 +1 3.11.15-150600.3.53.1 SUSE-SU-2026:1349-1
SLES for SAP 15 SP5 python3 +1 3.6.15-150300.10.109.1 SUSE-SU-2026:1090-1
SLES for SAP 15 SP5 python311 +2 3.11.15-150400.9.80.1 SUSE-SU-2026:1117-1
SLES for SAP 15 SP4 python3 +1 3.6.15-150300.10.109.1 SUSE-SU-2026:1090-1
SLES for SAP 15 SP4 python311 +2 3.11.15-150400.9.80.1 SUSE-SU-2026:1117-1
SLES 16.0 python313 +2 3.13.12-160000.1.1 SUSE-SU-2026:21178-1, SUSE-SU-2026:20581-1
SLE Micro 6.2 python313 +1 3.13.12-160000.1.1 SUSE-SU-2026:21104-1, SUSE-SU-2026:20543-1
SLE Micro 6.1 python311 +1 3.11.15-slfo.1.1_2.1 SUSE-SU-2026:20951-1
SLE Micro 6.0 python311 +1 3.11.15-2.1 SUSE-SU-2026:20956-1
SLE Micro 5.5 python3 +1 3.6.15-150300.10.109.1 SUSE-SU-2026:1090-1
SLE Micro 5.4 python3 +1 3.6.15-150300.10.109.1 SUSE-SU-2026:1090-1
SLE Micro 5.3 python3 +1 3.6.15-150300.10.109.1 SUSE-SU-2026:1090-1
SLE Micro 5.2 python3 +1 3.6.15-150300.10.109.1 SUSE-SU-2026:1090-1
SLE HPC 15 SP5 python3 +1 3.6.15-150300.10.109.1 SUSE-SU-2026:1090-1
SLE HPC 15 SP5 python311 +2 3.11.15-150400.9.80.1 SUSE-SU-2026:1117-1
SLE HPC 15 SP4 python3 +1 3.6.15-150300.10.109.1 SUSE-SU-2026:1090-1
SLE HPC 15 SP4 python311 +2 3.11.15-150400.9.80.1 SUSE-SU-2026:1117-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed python310 3.10.20-2.1 openSUSE-SU-2026:10404-1
openSUSE Tumbleweed python311 3.11.15-3.1 openSUSE-SU-2026:10398-1
openSUSE Tumbleweed python312 3.12.12-5.1 openSUSE-SU-2026:10222-1
openSUSE Tumbleweed python313 3.13.12-1.1 openSUSE-SU-2026:10223-1
openSUSE Tumbleweed python314 3.14.3-1.1 openSUSE-SU-2026:10206-1
openSUSE Leap 16.0 python313 +4 3.13.12-160000.1.1 openSUSE-SU-2026:20517-1, openSUSE-SU-2026:20254-1
openSUSE Leap 15.6 python +2 2.7.18-150000.108.1 SUSE-SU-2026:0873-1
openSUSE Leap 15.6 python3 +2 3.6.15-150300.10.109.1 SUSE-SU-2026:1090-1
openSUSE Leap 15.6 python311 +2 3.11.15-150600.3.53.1 SUSE-SU-2026:1349-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 python3 +7 3.9.25-1.amzn2023.0.4 ALAS2023-2026-1583
Amazon Linux 2023 python3.11 +6 3.11.14-1.amzn2023.0.4 ALAS2023-2026-1447
Amazon Linux 2023 python3.12 +6 3.12.12-2.amzn2023.0.4 ALAS2023-2026-1444
Amazon Linux 2023 python3.13 +8 3.13.12-1.amzn2023.0.1 ALAS2023-2026-1437
Amazon Linux 2 python3 +6 3.7.16-1.amzn2.0.23 ALAS2-2026-3184

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 docbook5-style-xsl No fix yet —
Azure Linux 3 python3 3.12.9-9 —
Azure Linux 2 (CBL-Mariner) python3 3.9.19-18 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 python3 +7 3.12.12-3.0.1.el10_1.1 ELSA-2026-4713
Oracle Linux 9 python3 +7 3.9.25-3.0.1.el9_7.1 ELSA-2026-4168
Oracle Linux 9 python3.11 +6 3.11.13-5.1.0.1.el9_7 ELSA-2026-4216
Oracle Linux 9 python3.12 +6 3.12.12-4.0.1.el9_7.1 ELSA-2026-4165
Oracle Linux 8 python3-idle +6 3.6.8-73.0.1.el8_10 ELSA-2026-2128
Oracle Linux 8 python3.11 +7 3.11.13-5.0.1.el8_10 ELSA-2026-4473
Oracle Linux 8 python3.12 +7 3.12.12-3.el8_10 ELSA-2026-4463
Oracle Linux 7 python3 +6 3.6.8-21.0.9.el7_9 ELSA-2026-6464

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling python-3.10 3.10.19-r4 —
Wolfi rolling python-3.11 3.11.14-r6 —
Wolfi rolling python-3.12 3.12.12-r5 —
Wolfi rolling python-3.13 3.13.12-r1 —
Wolfi rolling python-3.14 3.14.3-r1 —

Advisories 50

References