CVE-2025-11468
CVE-2025-11468 is a medium-severity vulnerability with a CVSS 4.0 base score of 5.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-93.
Key facts
- Severity: Medium (CVSS 4.0 base score 5.7)
- EPSS exploit prediction: 1% (42nd percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-206306
- Weakness: CWE-93
- Published:
- Last modified:
Description
When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.
Frequently asked questions
- What is CVE-2025-11468?
- When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.
- How severe is CVE-2025-11468?
- CVE-2025-11468 has a CVSS 4.0 base score of 5.7, rated medium severity.
- Is CVE-2025-11468 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (42nd percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2025-11468?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2025-11468 have an EU (EUVD) identifier?
- Yes. CVE-2025-11468 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-206306.
- When was CVE-2025-11468 published?
- CVE-2025-11468 was published on 2026-01-20 and last updated on 2026-06-17.
References
- https://github.com/python/cpython/commit/003b8315669b9f08b1010a49071f73f15f818094
- https://github.com/python/cpython/commit/17d1490aa97bd6b98a42b1a9b324ead84e7fd8a2
- https://github.com/python/cpython/commit/61614a5e5056e4f61ced65008d4576f3df34acb6
- https://github.com/python/cpython/commit/a76e4cd62dd68e7cbe86e37e6ed988495a646b66
- https://github.com/python/cpython/commit/e9970f077240c7c670e8a6fc6662f2b30d3b6ad0
- https://github.com/python/cpython/commit/f738386838021c762efea6c9802c82de65e87796
- https://github.com/python/cpython/issues/143935
- https://github.com/python/cpython/pull/143936
- https://mail.python.org/archives/list/[email protected]/thread/FELSEOLBI2QR6YLG6Q7VYF7FWSGQTKLI/
Other CWE-93 (CRLF Injection) vulnerabilities
- CVE-2024-51501 — Critical (CVSS 10.0): Refit is an automatic type-safe REST library for .NET Core, Xamarin and .NET The various header-related Refit…
- CVE-2026-45372 — Critical (CVSS 9.9): cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's…
- CVE-2026-11362 — Critical (CVSS 9.8): DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. DataDog::DogStatsd does not…
- CVE-2025-40671 — Critical (CVSS 9.3): SQL injection vulnerability in AES Multimedia's Gestnet v1.07. This vulnerability allows an attacker to retrieve,…
- CVE-2026-11373 — Critical (CVSS 9.1): Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections. Net::Statsite::Client is a client for…
- CVE-2026-50638 — Critical (CVSS 9.1): Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections. The statsd…