CVE-2025-15367 POP3 command injection in user-controlled commands

🗓️ 20 Jan 2026 21:47:09Reported by PSFType

vulnrichment🔗 github.com👁 6 Views

POP3 command injection in the poplib module via user controlled commands with newlines; mitigation rejects control characters.

Reporter	Title	Published	Views	Family All 414
FreeBSD	Python -- poplib module, when passed a user-controlled command, can have additional commands injected using newlines	20 Jan 202600:00	–	freebsd
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Operate / IBM Cloud Pak for AIOps	30 Jul 202613:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates	7 Apr 202616:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues	14 Apr 202615:27	–	ibm
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software	29 Jun 202615:52	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway for Multiplatforms.	21 May 202614:27	–	ibm
ATTACKERKB	CVE-2025-15367	20 Jan 202621:47	–	attackerkb
Tenable Nessus	Alibaba Cloud Linux 3 : 0035: python3 (ALINUX3-SA-2026:0035)	13 Feb 202600:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0061: python3.11 (ALINUX3-SA-2026:0061)	24 Mar 202600:00	–	nessus
Tenable Nessus	AlmaLinux 8 : python3 (ALSA-2026:2128)	6 Feb 202600:00	–	nessus

Source	Link
github	www.github.com/python/cpython/pull/143924
github	www.github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7
mail	www.mail.python.org/archives/list/[email protected]/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/
github	www.github.com/python/cpython/issues/143923

11 Feb 2026 16:12Current

5.4Medium risk

Vulners AI Score5.4

CVSS 45.9

EPSS0.00369

SSVC

pop3 command injection poplib module user controlled command newline injection control characters mitigation