Description

sethmlarson

opened on Jan 21, 2026

Issue body actions

Related:

• CVE-2024-6923
• email.policy.default - gotcha with re-using parsed headers with embedded newlines #121650

Linked PRs

• gh-144125: email: verify headers are sound in BytesGenerator #144126
• [3.10] gh-144125: email: verify headers are sound in BytesGenerator #144180
• [3.13] gh-144125: email: verify headers are sound in BytesGenerator #144181
• [3.14] gh-144125: email: verify headers are sound in BytesGenerator #144182
• [3.12] gh-144125: email: verify headers are sound in BytesGenerator #144188
• [3.11] gh-144125: email: verify headers are sound in BytesGenerator #144189

Activity

1. sethmlarson

   added

   type-securityA security issueA security issue

   stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

   topic-email

   on Jan 21, 2026
2. sethmlarson

   added 3 commits that reference this issue on Jan 21, 2026

   pythongh-144125: email: verify headers are sound in BytesGenerator

   cd41a69

   pythongh-144125: email: verify headers are sound in BytesGenerator

   1132e45

   gh-144125: email: verify headers are sound in BytesGenerator

   052e55e
3. miss-islington

   added 5 commits that reference this issue on Jan 23, 2026

   pythongh-144125: email: verify headers are sound in BytesGenerator

   127a2a9

   pythongh-144125: email: verify headers are sound in BytesGenerator

   7ef18bb

   pythongh-144125: email: verify headers are sound in BytesGenerator

   5a8bfd8

   pythongh-144125: email: verify headers are sound in BytesGenerator

   8df6632

   pythongh-144125: email: verify headers are sound in BytesGenerator

   15a6bd4
4. pablogsal

   added 3 commits that reference this issue on Jan 25, 2026

   [3.13] gh-144125: email: verify headers are sound in BytesGenerator (#…

   0a925ab

   [3.11] gh-144125: email: verify headers are sound in BytesGenerator (#…

   842ce19

   [3.10] gh-144125: email: verify headers are sound in BytesGenerator (#…

   8cdf620
5. hugovk

   added a commit that references this issue on Jan 25, 2026

   [3.14] gh-144125: email: verify headers are sound in BytesGenerator (#…

   7877fe4
6. frenzymadness

   added 2 commits that reference this issue on Jan 30, 2026

   00476: CVE-2026-1299

   fc9cc0f

   00476: CVE-2026-1299

   84728b6
7. hroncok

   added a commit that references this issue on Feb 3, 2026

   00476: CVE-2026-1299

   fad58bc
8. hrnciar

   added a commit that references this issue on Feb 10, 2026

   00476: CVE-2026-1299

   9363166
9. kbrezina commented on Feb 13, 2026

   

   kbrezina

   on Feb 13, 2026

   More actions

   Hey guys,
   I wonder whether I can expect 3.12.13 anytime soon? I suppose these changes are required for it.
   Thanks for info.
10. sethmlarson

    added a commit that references this issue on Feb 13, 2026

    [3.12] gh-144125: email: verify headers are sound in BytesGenerator

    e417f05
11. thunder-coding

    added a commit that references this issue on Feb 15, 2026

    pythongh-144125: email: verify headers are sound in BytesGenerator

    1fb91fb
12. StanFromIreland commented on Feb 18, 2026

    

    StanFromIreland

    on Feb 18, 2026

    Member

    More actions

    I wonder whether I can expect 3.12.13 anytime soon?

    As per the release schedule, they are "Provided irregularly on an as-needed basis."
13. StanFromIreland

    closed this as completedon Feb 18, 2026
14. kbrezina commented on Feb 19, 2026

    

    kbrezina

    on Feb 19, 2026

    More actions

    @StanFromIreland Thanks for info. Since CVE-2026-0672 and CVE-2026-1299 were fixed recently, I was hoping for a new 3.12 release.
15. hroncok

    added a commit that references this issue on Mar 26, 2026

    00476: CVE-2026-1299

    b8b991c
16. icanhasmath

    added a commit that references this issue on Oct 28, 2026

    [3.10] pythongh-144125: email: verify headers are sound in BytesGener…

    3364feb

Issue actions