Skip to main content

Python imaplib CVE-2025-15366

MEDIUM
Command Injection (CWE-77)
2026-01-20 cna@python.org
Command Injection
5.9
CVSS 4.0 · Vendor: python
Share

Severity by source

Vendor (python) PRIMARY
5.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.0 MEDIUM

AC:H reflects the prerequisite that an application must unsafely pass user input to imaplib; PR:H consistent with CVSS 4.0 source vector; no availability impact.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N
4.0 AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
6.7 MEDIUM
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
Red Hat
7.1 MEDIUM
qualitative

Primary rating from Vendor (python).

CVSS VectorVendor: python

Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

6
Source Code Evidence Fetched
Jul 24, 2026 - 08:29 vuln.today
CVSS changed
Jul 07, 2026 - 18:22 NVD
5.9 (MEDIUM)
Patch released
Mar 19, 2026 - 11:15 nvd
Patch available
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Jan 20, 2026 - 22:15 nvd
N/A
CVE Published
Jan 20, 2026 - 22:15 cve.org
MEDIUM 5.9

DescriptionCVE.org

The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

AnalysisAI

Command injection in Python's standard library imaplib module allows IMAP protocol command injection when applications pass unsanitized user-controlled input to imaplib functions. Embedding CRLF or other C0 control characters (0x00-0x1F) in arguments such as usernames or mailbox names causes the imaplib._command() method to transmit multiple IMAP protocol commands instead of one, enabling an attacker to inject arbitrary IMAP commands against the mail server. The fix, confirmed via multiple CPython commits and vendor advisories (Red Hat RHSA-2026:4713 et al., Ubuntu USN-8018-3), adds a regex guard rejecting all control characters before command transmission. No public exploit code and no KEV listing exist at time of analysis; EPSS is 0.09% (26th percentile), indicating very low exploitation probability.

Technical ContextAI

Python's imaplib module (Lib/imaplib.py) implements the IMAP4 client protocol. IMAP is a line-oriented protocol where commands are delimited by CRLF (\r\n). Prior to the fix, the internal _command() method forwarded raw byte arguments to the server socket without inspecting them for embedded control characters. An argument containing \r\n could prematurely terminate the in-progress IMAP command line and begin a new, attacker-controlled command - a classic CWE-77 (Improper Neutralization of Special Elements used in a Command) pattern. The fix introduces a compiled regex _control_chars = re.compile(b'[\x00-\x1F\x7F]') and raises ValueError on detection, applied before any bytes are written to the server. This vulnerability class is analogous to SMTP/HTTP header injection where protocol delimiters embedded in user data enable command smuggling. CPE data is not explicitly provided, but the affected component is the imaplib module bundled across multiple Python 3.x release trains, with fix commits visible across at least five branches.

Affected ProductsAI

The vulnerability affects Python's imaplib standard library module across multiple CPython 3.x maintenance branches. Five distinct fix commits are referenced (6262704b, d0921efb, f2cd7ef8, 29818227, 71926d94), indicating patches were backported to at least five active Python release series. Red Hat has issued advisories RHSA-2026:4713, RHSA-2026:5315, RHSA-2026:6007, RHSA-2026:5393, and RHSA-2026:6464 covering affected RHEL Python packages. Ubuntu issued USN-8018-3. SUSE is also listed as a downstream distributor of the fix. Exact minimum-affected and first-fixed version numbers per branch are not confirmed in available data - consult the CPython issue tracker at https://github.com/python/cpython/issues/143921 and the Python security announcement at https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/ for per-branch version details.

RemediationAI

Apply the patched Python release for the affected branch as distributed by the upstream CPython project or your OS vendor. Red Hat users should apply whichever of RHSA-2026:4713, RHSA-2026:5315, RHSA-2026:6007, RHSA-2026:5393, or RHSA-2026:6464 corresponds to their RHEL version (https://access.redhat.com/errata/). Ubuntu users should apply USN-8018-3 (https://ubuntu.com/security/notices/USN-8018-3). Exact patched version numbers per Python branch are not independently confirmed from available data - consult the upstream commit list at https://github.com/python/cpython/issues/143921. As an application-level compensating control where an OS or Python upgrade is not immediately possible, validate all user-supplied strings before passing them to any imaplib method by rejecting input containing bytes in the range 0x00-0x1F or 0x7F. This mirrors the fix logic exactly and eliminates the injection vector without requiring a Python upgrade. Note that filtering at the application layer duplicates what the patched imaplib provides, so it should be treated as temporary. No functionality trade-off exists for rejecting control characters in IMAP usernames, mailbox names, or flag arguments - these are not valid in the IMAP protocol.

Same weakness CWE-77 – Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2017-6327 HIGH POC
8.8
CVE-2023-34960 CRITICAL POC
9.8
CVE-2023-37679 CRITICAL POC
9.8

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container bci/bci-sle15-kernel-module-devel:15.7-56.13 Container bci/spack:latest Container suse/kea:2.6 Container suse/kiosk/pulseaudio:17.0-68.30 Container suse/ltss/sle15.4/bci-base-fips:15.4.2.55 Container suse/manager/5.0/x86_64/server-migration-14-16:latest Container suse/mariadb:11.8.5-72.5 Container suse/multi-linux-manager/5.1/x86_64/server-migration-14-16:5.1.3.8.16.1 Container suse/postgres:16.14 Container suse/postgres:17.10 Container suse/postgres:18.3-contrib-65.3 Container suse/samba-client:latest Container suse/samba-server:4.21-71.24 Container suse/samba-toolbox:latest Container suse/sle-micro-rancher/5.2:latest Container suse/sle-micro/5.2/toolbox:14.2-7.11.246 Container suse/sle-micro/5.3/toolbox:16.3-6.11.222 Container suse/sle-micro/5.4/toolbox:16.3-5.19.222 Container suse/sle-micro/5.5/toolbox:16.3-3.12.133 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GCE Image server-database-migration-image Affected
Container suse/389-ds:latest Affected
Container suse/manager/4.3/proxy-httpd:4.3.16.2.9.73.17 Container suse/manager/4.3/proxy-salt-broker:4.3.16.2.9.63.18 Container suse/manager/4.3/proxy-ssh:4.3.16.2.9.63.12 Container suse/manager/4.3/proxy-tftpd:4.3.16.2.9.63.13 Container suse/manager/5.0/x86_64/proxy-httpd:latest Container suse/manager/5.0/x86_64/proxy-salt-broker:latest Container suse/manager/5.0/x86_64/proxy-ssh:latest Container suse/manager/5.0/x86_64/proxy-tftpd:latest Container suse/multi-linux-manager/5.1/x86_64/proxy-httpd:5.1.3.8.18.1 Container suse/multi-linux-manager/5.1/x86_64/proxy-squid:5.1.3.8.16.1 Container suse/multi-linux-manager/5.1/x86_64/proxy-ssh:5.1.3.8.16.1 Container suse/multi-linux-manager/5.1/x86_64/proxy-tftpd:5.1.3.8.16.1 Image SLES15-SP4-CHOST-BYOS-GCE Image SLES15-SP4-Micro-5-3-BYOS Image SLES15-SP4-Micro-5-3-BYOS-Azure Image SLES15-SP4-Micro-5-4-BYOS Image SLES15-SP4-Micro-5-4-BYOS-Azure Image SLES15-SP5-CHOST-BYOS-GCE Image proxy-httpd-image Image proxy-squid-image Image proxy-ssh-image Image proxy-tftpd-image Affected
Container suse/manager/5.0/x86_64/server:latest Image SLES15-SP4-BYOS-GCE Image SLES15-SP4-HPC-BYOS-GCE Image SLES15-SP4-HPC-GCE Image SLES15-SP4-Hardened-BYOS-GCE Image SLES15-SP4-SAP-Azure-LI-BYOS Image SLES15-SP4-SAP-Azure-LI-BYOS-Production Image SLES15-SP4-SAP-Azure-VLI-BYOS Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production Image SLES15-SP4-SAP-BYOS-GCE Image SLES15-SP4-SAP-GCE Image SLES15-SP4-SAP-Hardened-BYOS-GCE Image SLES15-SP4-SAP-Hardened-GCE Image SLES15-SP4-SAPCAL-GCE Image SLES15-SP5-BYOS-GCE Image SLES15-SP5-GCE Image SLES15-SP5-HPC-BYOS-GCE Image SLES15-SP5-Hardened-BYOS-GCE Image SLES15-SP5-SAP-Azure-LI-BYOS Image SLES15-SP5-SAP-Azure-LI-BYOS-Production Image SLES15-SP5-SAP-Azure-VLI-BYOS Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production Image SLES15-SP5-SAP-BYOS-GCE Image SLES15-SP5-SAP-Hardened-BYOS-GCE Image SLES15-SP5-SAP-Hardened-GCE Image SLES15-SP5-SAPCAL-GCE Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-GCE Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS-GCE Image SLES15-SP6-SAP-Azure-LI-BYOS Image SLES15-SP6-SAP-Azure-LI-BYOS-Production Image SLES15-SP6-SAP-Azure-VLI-BYOS Image SLES15-SP6-SAP-Azure-VLI-BYOS-Production Image SLES15-SP6-SAP-BYOS-GCE Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAP-Hardened-BYOS-GCE Image SLES15-SP6-SAP-Hardened-GCE Image SLES15-SP6-SAPCAL-GCE Image SLES15-SP7-GCE Image SLES15-SP7-GCE-3P Image SLES15-SP7-SAP-Azure-LI-BYOS-Production Image SLES15-SP7-SAP-Azure-VLI-BYOS-Production Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-GCE-3P Image SLES15-SP7-SAP-Hardened-GCE Image SLES15-SP7-SAPCAL-GCE Affected
Container suse/multi-linux-manager/5.1/x86_64/proxy-salt-broker:5.1.3.9.16.1 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP7-EC2-ECS-HVM Image proxy-salt-broker-image Affected

Share

CVE-2025-15366 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy