CVE-2026-1299: email BytesGenerator header injection due to unquoted newlines
The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in "BytesGenerator".
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1299?
CVE-2026-1299 has been classified as a moderate severity vulnerability due to potential email header injection.
How do I fix CVE-2026-1299?
To fix CVE-2026-1299, you should update the email module to a patched version that appropriately quotes newlines in headers.
What impact does CVE-2026-1299 have on email systems?
CVE-2026-1299 allows an attacker to inject malicious headers into serialized email messages, potentially leading to phishing or spam.
Which versions of the email module are affected by CVE-2026-1299?
CVE-2026-1299 affects all versions of the email module prior to the release of the patch that addresses this vulnerability.
Is CVE-2026-1299 specific to a certain programming language?
Yes, CVE-2026-1299 specifically affects the Python 'email' module, particularly the 'BytesGenerator' class.