CVE-2025-15366
published 2026-01-20CVE-2025-15366: The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control…
PriorityP336medium5.9CVSS 4.0
AVNACLATPPRHUINVCLVIHVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.36%
28.2th percentile
The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | jython | < python3.9 3.9.2-1+deb11u5 (bullseye) | python3.9 3.9.2-1+deb11u5 (bullseye) |
| debian | pypy3 | < python3.9 3.9.2-1+deb11u5 (bullseye) | python3.9 3.9.2-1+deb11u5 (bullseye) |
| debian | python2.7 | < python3.9 3.9.2-1+deb11u5 (bullseye) | python3.9 3.9.2-1+deb11u5 (bullseye) |
| debian | python3.11 | < python3.9 3.9.2-1+deb11u5 (bullseye) | python3.9 3.9.2-1+deb11u5 (bullseye) |
| debian | python3.13 | < python3.9 3.9.2-1+deb11u5 (bullseye) | python3.9 3.9.2-1+deb11u5 (bullseye) |
| debian | python3.14 | < python3.9 3.9.2-1+deb11u5 (bullseye) | python3.9 3.9.2-1+deb11u5 (bullseye) |
| debian | python3.9 | < python3.9 3.9.2-1+deb11u5 (bullseye) | python3.9 3.9.2-1+deb11u5 (bullseye) |
| python_software_foundation | cpython | < 3.15.0a6 | 3.15.0a6 |
CVSS provenance
nvdv4.05.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv5.9MEDIUM
vendor_debian5.9MEDIUM
vendor_redhat5.9MEDIUM
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Python 2.7 vulnerabilities
vendor_ubuntu·2026-03-19·CVSS 5.3
CVE-2025-12084 [MEDIUM] Python 2.7 vulnerabilities
Title: Python 2.7 vulnerabilities
Summary: Several security issues were fixed in python2.7
USN-8018-1 fixed CVE-2025-12084, CVE-2025-15282, CVE-2026-0672,
CVE-2026-0865 for python3. This update provides the corresponding updates
for python2.7.
Original advisory details:
Denis Ledoux discovered that Python incorrectly parsed email message
headers. An attacker could possibly use this issue to inject arbitrary
headers into email messages. This issue only affected python3.6,
python3.7, python3.8, python3.9, python3.10, python3.11, python3.12,
python3.13, and python3.14 packages. (CVE-2025-11468)
Jacob Walls, Shai Berger, and Natalia Bidart discovered that Python
inefficiently parsed XML input with quadratic complexity. An attacker
could possibly use this issue to cause a denial of service
Ubuntu
Python regression
vendor_ubuntu·2026-03-09·CVSS 5.3
CVE-2025-15367 [MEDIUM] Python regression
Title: Python regression
Summary: USN-8018-1 introduced a regression in Python
USN-8018-1 fixed vulnerabilities in python3. That update introduced
regressions. The patches for CVE-2025-15366 and CVE-2025-15367 caused
behavior regressions in IMAP and POP3 handling, which upstream chose to
avoid by not backporting them. Additionally, the patch for CVE-2026-0865
incorrectly rejected horizontal tabs in wsgiref headers. This update fixes
these problems.
We apologize for the inconvenience.
Original advisory details:
Denis Ledoux discovered that Python incorrectly parsed email message
headers. An attacker could possibly use this issue to inject arbitrary
headers into email messages. This issue only affected python3.6,
python3.7, python3.8, python3.9, python3.10, python3.11, python3.12,
pytho
Ubuntu
Python vulnerabilities
vendor_ubuntu·2026-02-05·CVSS 5.3
CVE-2025-15366 [MEDIUM] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
Denis Ledoux discovered that Python incorrectly parsed email message
headers. An attacker could possibly use this issue to inject arbitrary
headers into email messages. This issue only affected python3.6, python3.7,
python3.8, python3.9, python3.10, python3.11, python3.12, python3.13, and
python3.14 packages. (CVE-2025-11468)
Jacob Walls, Shai Berger, and Natalia Bidart discovered that Python
inefficiently parsed XML input with quadratic complexity. An attacker could
possibly use this issue to cause a denial of service. (CVE-2025-12084)
It was discovered that Python incorrectly parsed malicious plist files. An
attacker could possibly use this issue to cause Python to use excessive
resources, leading to
Red Hat
cpython: IMAP command injection in user-controlled commands
vendor_redhat·2026-01-20·CVSS 5.9
CVE-2025-15366 [MEDIUM] CWE-77 cpython: IMAP command injection in user-controlled commands
cpython: IMAP command injection in user-controlled commands
The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
A flaw was found in the imaplib module in the Python standard library. The imaplib module does not reject control characters, such as newlines, in user-controlled input passed to IMAP commands. This issue allows an attacker to inject additional commands to be executed in the IMAP server.
Statement: To exploit this issue, an attacker needs to have the privileges required to send malicious input to an application that sends IMAP commands to a server. Additionally, this flaw can allow attackers to manipulate the state of the mailbox (e.g., delete emails, move fo
Debian
CVE-2025-15366: jython - The imaplib module, when passed a user-controlled command, can have additional c...
vendor_debian·2025·CVSS 5.9
CVE-2025-15366 [MEDIUM] CVE-2025-15366: jython - The imaplib module, when passed a user-controlled command, can have additional c...
The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
VulDB
Python CPython up to 3.14.x Imaplib command injection (EUVD-2025-206304 / Nessus ID 296553)
vuldb·2026-07-07·CVSS 5.9
CVE-2025-15366 [MEDIUM] Python CPython up to 3.14.x Imaplib command injection (EUVD-2025-206304 / Nessus ID 296553)
A vulnerability was found in Python CPython up to 3.14.x and classified as critical. This issue affects some unknown processing of the component Imaplib Module. Such manipulation leads to command injection.
This vulnerability is listed as CVE-2025-15366. The attack may be performed from remote. There is no available exploit.
It is suggested to upgrade the affected component.
OSV
python2.7 vulnerabilities
osv·2026-03-19·CVSS 5.7
CVE-2025-12084 [MEDIUM] python2.7 vulnerabilities
python2.7 vulnerabilities
USN-8018-1 fixed CVE-2025-12084, CVE-2025-15282, CVE-2026-0672,
CVE-2026-0865 for python3. This update provides the corresponding updates
for python2.7.
Original advisory details:
Denis Ledoux discovered that Python incorrectly parsed email message
headers. An attacker could possibly use this issue to inject arbitrary
headers into email messages. This issue only affected python3.6,
python3.7, python3.8, python3.9, python3.10, python3.11, python3.12,
python3.13, and python3.14 packages. (CVE-2025-11468)
Jacob Walls, Shai Berger, and Natalia Bidart discovered that Python
inefficiently parsed XML input with quadratic complexity. An attacker
could possibly use this issue to cause a denial of service.
(CVE-2025-12084)
It was discovered that Python incorrectly pars
OSV
python3.4, python3.5, python3.6, python3.7, python3.8, python3.9,
python3.10, python3.11, python3.12, python3.13, python3.14 regression
osv·2026-03-09·CVSS 5.7
CVE-2025-15366 [MEDIUM] python3.4, python3.5, python3.6, python3.7, python3.8, python3.9,
python3.10, python3.11, python3.12, python3.13, python3.14 regression
python3.4, python3.5, python3.6, python3.7, python3.8, python3.9,
python3.10, python3.11, python3.12, python3.13, python3.14 regression
USN-8018-1 fixed vulnerabilities in python3. That update introduced
regressions. The patches for CVE-2025-15366 and CVE-2025-15367 caused
behavior regressions in IMAP and POP3 handling, which upstream chose to
avoid by not backporting them. Additionally, the patch for CVE-2026-0865
incorrectly rejected horizontal tabs in wsgiref headers. This update fixes
these problems.
We apologize for the inconvenience.
Original advisory details:
Denis Ledoux discovered that Python incorrectly parsed email message
headers. An attacker could possibly use this issue to inject arbitrary
headers into email messages. This issue only affected python3.6,
python3.7, python3
OSV
python3.14, python3.13, python3.12, python3.11, python3.10, python3.9,
python3.8, python3.7, python3.6, python3.5, python3.4 vulnerabilities
osv·2026-02-05·CVSS 5.7
CVE-2025-11468 [MEDIUM] python3.14, python3.13, python3.12, python3.11, python3.10, python3.9,
python3.8, python3.7, python3.6, python3.5, python3.4 vulnerabilities
python3.14, python3.13, python3.12, python3.11, python3.10, python3.9,
python3.8, python3.7, python3.6, python3.5, python3.4 vulnerabilities
Denis Ledoux discovered that Python incorrectly parsed email message
headers. An attacker could possibly use this issue to inject arbitrary
headers into email messages. This issue only affected python3.6, python3.7,
python3.8, python3.9, python3.10, python3.11, python3.12, python3.13, and
python3.14 packages. (CVE-2025-11468)
Jacob Walls, Shai Berger, and Natalia Bidart discovered that Python
inefficiently parsed XML input with quadratic complexity. An attacker could
possibly use this issue to cause a denial of service. (CVE-2025-12084)
It was discovered that Python incorrectly parsed malicious plist files. An
attacker could possibly use this issue
GHSA
GHSA-4c67-8q63-xrxq: The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines
ghsa_unreviewed·2026-01-21
CVE-2025-15366 [MEDIUM] CWE-77 GHSA-4c67-8q63-xrxq: The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines
The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
OSV
CVE-2025-15366: The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines
osv·2026-01-20·CVSS 5.9
CVE-2025-15366 [MEDIUM] CVE-2025-15366: The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines
The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-15366 asahi-installer: IMAP command injection in user-controlled commands [fedora-42]
bugzilla·2026-01-21·CVSS 5.9
CVE-2025-15366 [MEDIUM] CVE-2025-15366 asahi-installer: IMAP command injection in user-controlled commands [fedora-42]
CVE-2025-15366 asahi-installer: IMAP command injection in user-controlled commands [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'.
Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, ch
Bugzilla
CVE-2025-15366 cpython: IMAP command injection in user-controlled commands
bugzilla·2026-01-20·CVSS 5.9
CVE-2025-15366 [MEDIUM] CVE-2025-15366 cpython: IMAP command injection in user-controlled commands
CVE-2025-15366 cpython: IMAP command injection in user-controlled commands
The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2026:2128 https://access.redhat.com/errata/RHSA-2026:2128
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2026:4165 https://access.redhat.com/errata/RHSA-2026:4165
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2026:4168 https://access.redhat.com/errata/RHSA-2026:4168
---
This issue has been addressed in the following products:
Red
Wiz
CVE-2025-15366 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.9
CVE-2025-15366 [MEDIUM] CVE-2025-15366 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-15366 :
Rocky Linux vulnerability analysis and mitigation
The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
Source : NVD
## 5.9
Score
Published January 20, 2026
Severity MEDIUM
CNA Score 5.9
Affected Technologies
Rocky Linux
Python Interpreter
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 23.8
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
python311-testsuite
python36:3.6::python-pymongo
Sources
AlmaLinux 8 Severity MEDIUM Has Fix Added at: Feb 08, 2026
AlmaLinux 9 Severity MEDIUM Has Fix Added at: Mar 12, 2026
Chainguard
https://github.com/python/cpython/commit/298182272a740ce2016aee2f54acbd0bba1944c1https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45https://github.com/python/cpython/commit/71926d943c05bde79bd2a866933103541d91b6a2https://github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649dhttps://github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736ahttps://github.com/python/cpython/issues/143921https://github.com/python/cpython/pull/143922https://mail.python.org/archives/list/[email protected]/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/
2026-01-20
Published