CVE-2025-15367 POP3 command injection in user-controlled commands

The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters...

CVE-2025-15366

The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters...

CVE-2025-15366 IMAP command injection in user-controlled commands

The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters...

CVE-2025-15366 IMAP command injection in user-controlled commands

The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters...

CVE-2025-15366

CVE-2025-15366 affects Python’s imaplib module, where a user-controlled command can be extended with additional commands via newline characters, enabling command injection in IMAP handling. Multiple Nessus advisories corroborate this CVE among Python-related issues, with remediation described as ...

CVE-2025-15366

The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters...

PSF-2026-3

The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters...

CVE-2025-15282

CVE-2025-15282 concerns Python’s urllib.request DataHandler, where user-controlled data URLs can inject HTTP headers due to improper parsing of data URL mediatypes. Connected sources show fixes in CPython commits addressing this header-injection surface in the urllib module, indicating the underl...

HTTP Response Splitting

Overview Affected versions of this package are vulnerable to HTTP Response Splitting via the wsgiref.headers.Headers. An attacker can manipulate HTTP responses by injecting arbitrary headers through user-controlled input containing newline characters. Remediation A fix was pushed into the master...

CVE-2025-11468

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized...

CVE-2025-11468 Folding email comments of unfoldable characters doesn't preserve parenthesis

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized...

CVE-2025-11468

CVE-2025-11468 refers to a Python vulnerability where folding a long comment in an email header that contains exclusively unfoldable characters can cause the parenthesis to be lost, enabling header injection when the addresses are user-controlled. The issue is tied to Python’s email/header handli...

CVE-2025-11468 Folding email comments of unfoldable characters doesn't preserve parenthesis

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized...

CVE-2025-11468

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized...

PSF-2026-1

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized...

CVE-2025-11468 Folding email comments of unfoldable characters doesn't preserve parenthesis

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized...

CLSA-2026-1768587600 git: Fix of 2 CVEs

CVE-2025-52005: add sideband.allowControlCharacters config which gives a possibility to avoid control characters in sideband - CVE-2024-52006: fix newline confusion in credential helpers that can lead to credential exfiltration...

MiracleLinux 7 : xterm-295-3.el7.1 (AXSA:2021-1554:03)

The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2021-1554:03 advisory. xterm: crash when processing combining characters CVE-2021-27135 Tenable has extracted the preceding description block directly from the MiracleLinux securit...

MiracleLinux 8 : curl-7.61.1-30.el8 (AXSA:2023-5803:08)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-5803:08 advisory. curl: Incorrect handling of control code characters in cookies CVE-2022-35252 curl: Use-after-free triggered by an HTTP proxy deny response...

Python -- imaplib module, when passed a user-controlled command, can have additional commands injected using newlines

Python Software Foundation Security Developer reports: The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing specific control characters...