CVE-2026-1299
MediumSummary
The email module in Python, specifically the BytesGenerator class, improperly quotes newlines in email headers during serialization, allowing header injection. This only affects usage of LiteralHeader that does not respect email folding.
Risk Assessment
An attacker can inject malicious headers into an email message, potentially leading to content spoofing, redirection, or other header-based attacks.
Recommendation
Update Python to a version that fixes this vulnerability, or avoid using LiteralHeader in the email module until a patch is applied.
Original NVD description (English source)
The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email foldin