During folding of email address lists, a comma at the end of a folded line is incorrectly Unicode‑encoded when the line is processed for encoding; the comma should remain plain. This misencoding can cause mail servers to misinterpret the recipient address, potentially leading to delivery to an unintended recipient; the possibility of spoofing is inferred but not explicitly stated in the CVE description.

The flaw exists in CPython, the reference interpreter for Python, and affects any deployment that processes email headers containing folded address lists. Affected releases include all CPython versions that contain the unpatched header‑folding code. Specific version details are not listed in the advisory, but all CPython releases prior to the application of the commits referenced in the advisory are impacted.

The CVSS score of 2.3 indicates low severity, and the EPSS score of less than 1% suggests a very low probability of exploitation at present. The vulnerability does not allow remote code execution or privilege escalation; it mainly permits email header manipulation, which might be leveraged for phishing or deliverability issues (these implications are inferred from the manipulation ability but not stated explicitly in the CVE description). The flaw is not listed in the CISA KEV catalog, and no publicly known exploits have been documented. Attackers would need to craft an email with a folded address header that contains a comma incorrectly encoded, which requires send access to a mail system that processes such headers.