CVE-2026-1299: Email Module Header Injection Vulnerability

CVE-2026-1299 Overview

CVE-2026-1299 is a header injection vulnerability in the Python email module, specifically affecting the BytesGenerator class. The vulnerability occurs due to improper quoting of newlines for email headers when serializing an email message. This allows attackers to inject arbitrary headers when an email is serialized, potentially enabling email spoofing, phishing attacks, or bypassing email security controls.

This vulnerability is specifically applicable when using LiteralHeader to write headers that don't respect email folding rules. The updated behavior rejects incorrectly folded headers in BytesGenerator.

Critical Impact

Attackers can inject arbitrary email headers during message serialization, potentially enabling email spoofing, phishing campaigns, or bypassing security controls in email processing applications.

Affected Products

• Python email module (BytesGenerator class)
• Applications using LiteralHeader for email header serialization
• Email processing systems relying on Python's email library

Discovery Timeline

• 2026-01-23 - CVE CVE-2026-1299 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2026-1299

Vulnerability Analysis

This vulnerability is classified as CWE-93 (Improper Neutralization of CRLF Sequences), commonly known as CRLF Injection or HTTP Response Splitting when applied to HTTP contexts. In this case, it manifests as email header injection.

The BytesGenerator class in Python's email module is responsible for serializing email messages into byte format for transmission. The vulnerability arises because the class fails to properly quote or escape newline characters (CR/LF sequences) within email headers during the serialization process.

When an attacker controls input that becomes part of an email header, they can inject newline characters followed by additional header content. Since email headers are separated by newlines, this allows the injection of entirely new headers into the outgoing email message.

The attack requires network access and low privileges, but depends on specific conditions being present—namely, the application must be using LiteralHeader for writing headers that don't follow standard email folding rules.

Root Cause

The root cause of this vulnerability is insufficient input validation and sanitization in the BytesGenerator class when processing email header content. The class did not properly quote or escape newline characters (CRLF sequences) present in header values before serialization.

Specifically, when LiteralHeader is used to write headers that bypass standard email folding rules, the BytesGenerator class would pass through unescaped newline sequences, allowing attackers to terminate the current header and inject additional malicious headers.

Attack Vector

The attack vector is network-based, requiring an attacker to provide malicious input that gets incorporated into email headers. The exploitation scenario typically involves:

1. An attacker identifies an application that uses Python's email module with LiteralHeader for email generation
2. The attacker provides input containing CRLF sequences (e.g., \r\n) followed by injected header content
3. When the email is serialized using BytesGenerator, the malicious newlines are not properly escaped
4. The resulting email contains attacker-controlled headers, which could include spoofed From addresses, additional recipients via Bcc, or manipulated Subject lines

The vulnerability enables header injection attacks that could be leveraged for phishing, spam distribution, or bypassing email authentication mechanisms.

Detection Methods for CVE-2026-1299

Indicators of Compromise

• Outbound emails containing unexpected or duplicate headers
• Email logs showing malformed header structures or CRLF sequences in header values
• Reports of spoofed emails originating from legitimate application infrastructure

Detection Strategies

• Monitor email generation logs for unusual header patterns or CRLF sequences in header values
• Implement email gateway rules to flag outbound messages with suspicious header structures
• Review application code for usage of LiteralHeader with user-controlled input

Monitoring Recommendations

• Enable verbose logging for email serialization operations in Python applications
• Configure email security gateways to alert on emails with non-standard header formatting
• Audit applications using Python's email module for proper input sanitization

How to Mitigate CVE-2026-1299

Immediate Actions Required

• Update Python to a patched version that rejects incorrectly folded headers in BytesGenerator
• Review and sanitize all user-controlled input that may be incorporated into email headers
• Consider implementing additional input validation at the application layer before email serialization

Patch Information

The Python development team has released patches to address this vulnerability. The updated BytesGenerator class now rejects incorrectly folded headers when using LiteralHeader. Multiple commits have been applied to the cpython repository:

• GitHub cpython Commit Fix
• GitHub cpython Commit Update
• GitHub cpython Commit Bugfix

For additional details, refer to the GitHub cpython Issue Discussion, GitHub cpython Pull Request, and the Python Security Announcement Email.

Workarounds

• Avoid using LiteralHeader with user-controlled input until patches are applied
• Implement strict input validation to strip or reject CRLF sequences from any data used in email headers
• Use standard email header APIs that enforce proper folding rules rather than LiteralHeader