TI-2025-01547 Aliases CVE-2025-1795 GHSA-c266-vjjr-2v8j

Mishandling of comma during folding and unicode-encoding of email headers

LOW 13CWE-116Published 2025-02-28 · Updated 2026-07-31

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: Low · None · None
Fix status: Partial Red Hat: 6 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00628 50th percentileScored 2026-11-07

Fix Partial CPython (Python Software Foundation): 3.9.23, 3.10.17, 3.11.9 +2Red Hat: 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Python Software Foundation	CPython	before 3.9.23; 3.10.0 to before 3.10.17; 3.11.0 to before 3.11.9; 3.12.0 to before 3.12.3; 3.13.0a1 to before 3.13.0a5	3.9.23, 3.10.17, 3.11.9, 3.12.3, 3.13.0a5	Patch available	CNA

CPython VendorPython Software Foundation Affected before 3.9.23; 3.10.0 to before 3.10.17; 3.11.0 to before 3.11.9; 3.12.0 to before 3.12.3; 3.13.0a1 to before 3.13.0a5 Fixed in 3.9.23, 3.10.17, 3.11.9, 3.12.3, 3.13.0a5 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:python:python::::::::	—	—	python-pillow

cpe:2.3:a:python:python:*:*:*:*:*:*:*:* Versions — — ·python-pillow

Remediation

Fix · CNA CPython (Python Software Foundation) Fixed in 3.9.23, 3.10.17, 3.11.9, 3.12.3, 3.13.0a5

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 6	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 7	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)	Affected	—

Not affected: 1 product

Red Hat Enterprise Linux 9

Timeline

2026-10-02 Threatist record created from CVE-2025-1795
2026-10-03 Alias added: GHSA-c266-vjjr-2v8j
2026-10-30 EPSS moved to the 50th–90th percentile
2026-11-06 Affected versions changed · Red Hat

References

Patch 7

Advisory 1

https://mail.python.org/archives/list/[email protected]/thread/MB62IZMEC3UM6SGHP5LET5JX2Y7H4ZUR/

Other 1

https://github.com/python/cpython/issues/100884

TI-2024-07037 Quadratic complexity parsing cookies with backslashes CVSS 3.1HIGH 7.5
TI-2024-11791 Bypass extraction filter to modify file metadata outside extraction directory CVSS 3.1MEDIUM 5.3
TI-2024-00411 Quoted zip-bomb protection for zipfile CVSS 3.1MEDIUM 6.2
TI-2026-13296 `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching CVSS 4.0MEDIUM 6.0
TI-2024-06422 Email header injection due to unquoted newlines CVSS 3.1MEDIUM 5.5
TI-2026-04606 Possible to hijack modules in current working directory CVSS 4.0MEDIUM 5.6

See all 83 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences