TI-2025-14016 CVE-2025-15367 · GHSA-g82h-mgfp-jx8g
POP3 command injection in user-controlled commands
Priority LOW 29
The poplib module, when passed a user-controlled command, can have additional commands injected using newlines.
RHSA-2026:4713
python3.12 security update
Released 2026-03-17 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 10) python-unversioned-command-3.12.12-3.el10_1.1, python3-devel-3.12.12-3.el10_1.1, python3-tkinter-3.12.12-3.el10_1.1
- Red Hat Enterprise Linux BaseOS (v. 10) python3-3.12.12-3.el10_1.1, python3-libs-3.12.12-3.el10_1.1, python3.12-3.12.12-3.el10_1.1
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) python3-debug-3.12.12-3.el10_1.1, python3-idle-3.12.12-3.el10_1.1, python3-test-3.12.12-3.el10_1.1
Fixes 4 records
TI-2025-14015 CVE-2025-15366 · GHSA-4c67-8q63-xrxq
IMAP command injection in user-controlled commands
Priority LOW 29
The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines.
TI-2026-01014 CVE-2026-1299 · GHSA-jh94-8q48-f3m3
email BytesGenerator header injection due to unquoted newlines
Priority LOW 28
The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.
TI-2026-00646 CVE-2026-0865 · GHSA-5mc7-p6pj-r3f5
wsgiref.headers.Headers allows header newline injection
Priority LOW 27
User-controlled header names and values containing newlines can allow injecting HTTP headers.