CVE-2025-1795: Python Software Foundation Cpython

Low severity, CVSS 2.3. EPSS: 0.6% chance of exploitation in the next 30 days.

During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers.

Affected products

• Python Software Foundation Cpython: before 3.9.23 (fixed in 3.9.23); from 3.10.0, before 3.10.17 (fixed in 3.10.17); from 3.11.0, before 3.11.9 (fixed in 3.11.9); from 3.12.0, before 3.12.3 (fixed in 3.12.3); from 3.13.0a1, before 3.13.0a5 (fixed in 3.13.0a5)

Published 2025-02-28. Last modified 2026-07-31.