CVE-2025-11468

Description

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.

How to fix CVE-2025-11468

To remediate CVE-2025-11468, upgrade the affected package to a fixed version below.

• Bitnami/libpython—upgrade to 3.10.20 or later
• Bitnami/python—upgrade to 3.10.20 or later
• —upgrade to 3.10.20 or later
• —no fix listed
• —upgrade to 3.11.2-6+deb12u7 or later
• —upgrade to 3.13.5-2+deb13u1 or later
• —upgrade to 3.14.3-1 or later
• —upgrade to 3.9.2-1+deb11u5 or later
• —upgrade to 3.9.2-1+deb11u5 or later

Is CVE-2025-11468 being exploited?

Low — EPSS is 0.5%, meaning exploitation activity has not been observed at scale.

Affected packages (9)

• from 0, < 3.10.20, >= 3.11.0, < 3.11.15, >= 3.12.0, < 3.12.13, >= 3.13.0, < 3.13.12, >= 3.14.0, < 3.14.3
• from 0, < 3.10.20, >= 3.11.0, < 3.11.15, >= 3.12.0, < 3.12.13, >= 3.13.0, < 3.13.12, >= 3.14.0, < 3.14.3
• from 0, < 3.10.20, >= 3.11.0, < 3.11.15, >= 3.12.0, < 3.12.13, >= 3.13.0, < 3.13.12, >= 3.14.0, < 3.14.3
• from 0
• from 0, < 3.11.2-6+deb12u7
• from 0, < 3.13.5-2+deb13u1
• from 0, < 3.14.3-1
• from 0, < 3.9.2-1+deb11u5
• from 0, < 3.9.2-1+deb11u5

CVSS scores

References (11)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2025-11468
• WEBgithub.com/python/cpython/commit/003b8315669b9f08b1010a49071f73f15f818094
• WEBgithub.com/python/cpython/commit/17d1490aa97bd6b98a42b1a9b324ead84e7fd8a2
• WEBgithub.com/python/cpython/commit/61614a5e5056e4f61ced65008d4576f3df34acb6