The BytesGenerator class in CPython’s email module failed to quote newline characters in headers during serialization, enabling an attacker who can influence header data to inject arbitrary email headers. The flaw manifests when using the LiteralHeader writer, which does not enforce email folding rules. Successful exploitation could lead to email spoofing, content corruption, or delivery of malicious content to recipients.

All CPython installations that employ the email module’s BytesGenerator with the LiteralHeader writer are vulnerable. The exact version range is not specified, so any build prior to the commit that introduced the fix should be considered affected.

The CVSS score of six reflects a moderate severity, while the EPSS probability of less than one percent indicates low likelihood of widespread exploitation. The vulnerability is not present in the CISA KEV list, suggesting it has not been observed in the wild. Likely attack vectors involve applications that construct and send email messages using untrusted header input, giving an attacker the capacity to manipulate header fields. The absence of a KEV listing reduces urgency, but the nature of header injection remains a valid concern for message integrity.