CVE-2025-1795 Mishandling of comma during folding and unicode-encoding of email headers
Incorrect comma encoding in email headers can cause mail server misinterpretation, affecting Python applications using the email module.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-1795?
CVE-2025-1795 is a low-severity vulnerability in CPython, published on 28 Feb 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers.
Weakness: CWE-116
Which versions are affected by CVE-2025-1795?
3 open source packages ship an affected version, including libpython, python and python-min.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.9.23, 3.10.17, 3.11.9, 3.12.3 |
python Bitnami | All versions | 3.9.23, 3.10.17, 3.11.9, 3.12.3 |
python-min Bitnami | All versions | 3.9.23, 3.10.17, 3.11.11, 3.12.8 |
Linux distribution packages (16)
python311-core SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 3.11.11-150600.3.21.1 |
python311 SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | All versions | 3.11.11-150400.9.49.1 |
python311-core SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | All versions | 3.11.11-150400.9.49.1 |
python311 SUSE:Linux Enterprise Module for Python 3 15 SP6 | All versions | 3.11.11-150600.3.21.1 |
python311-core SUSE:Linux Enterprise Module for Python 3 15 SP6 | All versions | 3.11.11-150600.3.21.1 |
python312 SUSE:Linux Enterprise Module for Python 3 15 SP6 | All versions | 3.12.9-150600.3.21.1 |
python312-core SUSE:Linux Enterprise Module for Python 3 15 SP6 | All versions | 3.12.9-150600.3.21.1 |
python311 openSUSE:Leap 15.6 | All versions | 3.11.11-150600.3.21.1 |
python311-core openSUSE:Leap 15.6 | All versions | 3.11.11-150600.3.21.1 |
python311-documentation openSUSE:Leap 15.6 | All versions | 3.11.11-150600.3.21.1 |
python312 openSUSE:Leap 15.6 | All versions | 3.12.9-150600.3.21.1 |
python312-core openSUSE:Leap 15.6 | All versions | 3.12.9-150600.3.21.1 |
python312-documentation openSUSE:Leap 15.6 | All versions | 3.12.9-150600.3.21.1 |
python311 openSUSE:Tumbleweed | All versions | 3.11.11-4.1 |
python312 openSUSE:Tumbleweed | All versions | 3.12.9-2.1 |
python313 openSUSE:Tumbleweed | All versions | 3.13.2-3.1 |
How do I fix CVE-2025-1795?
Upgrade libpython to a fixed version for your release line: 3.9.23, 3.10.17, 3.11.9 or 3.12.3.
Is CVE-2025-1795 being exploited?
There is no known exploitation of CVE-2025-1795 in the wild and no public exploit code.
Sources
Also known as AZL-57675, BIT-libpython-2025-1795, BIT-python-2025-1795, BIT-python-min-2025-1795, CLSA-2025-1755270833, DEBIAN-CVE-2025-1795 and 12 more.