CVE-2019-16056 Other in n/a

Medium 5.3 Published 6 Sep 2019 Updated 14 Oct 2026

The Python email module incorrectly parses addresses with multiple @ symbols, allowing attackers to bypass header validation checks in applications using this library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-16056?

CVE-2019-16056 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 6 Sep 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.

Weakness: CWE-20

Which versions are affected by CVE-2019-16056?

It affects 10 products.

Linux distribution packages (25)

`python` Red Hat:rhel_eus:7.7::computenode	All versions	`0:2.7.5-87.el7_7`
`python-debug` Red Hat:rhel_eus:7.7::computenode	All versions	`0:2.7.5-87.el7_7`
`python-debuginfo` Red Hat:rhel_eus:7.7::computenode	All versions	`0:2.7.5-87.el7_7`
`python-devel` Red Hat:rhel_eus:7.7::computenode	All versions	`0:2.7.5-87.el7_7`
`python-libs` Red Hat:rhel_eus:7.7::computenode	All versions	`0:2.7.5-87.el7_7`
`python-test` Red Hat:rhel_eus:7.7::computenode	All versions	`0:2.7.5-87.el7_7`
`python-tools` Red Hat:rhel_eus:7.7::computenode	All versions	`0:2.7.5-87.el7_7`
`tkinter` Red Hat:rhel_eus:7.7::computenode	All versions	`0:2.7.5-87.el7_7`
`python` Red Hat:rhel_eus:7.7::server	All versions	`0:2.7.5-87.el7_7`
`python-debug` Red Hat:rhel_eus:7.7::server	All versions	`0:2.7.5-87.el7_7`
`python-debuginfo` Red Hat:rhel_eus:7.7::server	All versions	`0:2.7.5-87.el7_7`
`python-devel` Red Hat:rhel_eus:7.7::server	All versions	`0:2.7.5-87.el7_7`
`python-libs` Red Hat:rhel_eus:7.7::server	All versions	`0:2.7.5-87.el7_7`
`python-test` Red Hat:rhel_eus:7.7::server	All versions	`0:2.7.5-87.el7_7`
`python-tools` Red Hat:rhel_eus:7.7::server	All versions	`0:2.7.5-87.el7_7`
`tkinter` Red Hat:rhel_eus:7.7::server	All versions	`0:2.7.5-87.el7_7`
`python3` SUSE:Linux Enterprise Module for Basesystem 15 SP1	All versions	`3.6.10-3.53.1`
`python3-base` SUSE:Linux Enterprise Module for Basesystem 15 SP1	All versions	`3.6.10-3.53.1`
`python3-base` SUSE:Linux Enterprise Module for Development Tools 15 SP1	All versions	`3.6.10-3.53.1`
`python` SUSE:Linux Enterprise Point of Sale 11 SP3	All versions	`2.6.9-40.32.2`
`python-base` SUSE:Linux Enterprise Point of Sale 11 SP3	All versions	`2.6.9-40.32.1`
`python-doc` SUSE:Linux Enterprise Point of Sale 11 SP3	All versions	`2.6-8.40.32.1`
`python` SUSE:Linux Enterprise Server 11 SP4-LTSS	All versions	`2.6.9-40.32.2`
`python-base` SUSE:Linux Enterprise Server 11 SP4-LTSS	All versions	`2.6.9-40.32.1`
`python-doc` SUSE:Linux Enterprise Server 11 SP4-LTSS	All versions	`2.6-8.40.32.1`

Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Opensuse Leap, Oracle Communications Operations Monitor, Oracle Peoplesoft Enterprise Peopletools and 4 more.

How do I fix CVE-2019-16056?

Upgrade to a fixed version.

Is CVE-2019-16056 being exploited?

There is no known exploitation of CVE-2019-16056 in the wild and no public exploit code.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2019-16056, AZL-109629, CLEANSTART-2026-VJ78698, DEBIAN-CVE-2019-16056, DLA-1924-1, DLA-1925-1 and 6 more.