VDB

GHSA-jh94-8q48-f3m3

GHSA-jh94-8q48-f3m3 PUBLISHED CVSS 6 MEDIUM

Record from GitHub Advisory Database · Published January 23, 2026

The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in "BytesGenerator".

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
python-3.13Wolfi3.13.12-r1
python-3.13Chainguard3.13.12-r1
python-3.14Wolfi3.14.3-r1
python-3.10Chainguard3.10.19-r4
python-3.10Wolfi3.10.19-r4
python-3.14Chainguard3.14.3-r1
python-3.11Wolfi3.11.14-r6
python-3.12Wolfi3.12.12-r5
python-3.11Chainguard3.11.14-r6
python-3.12Chainguard3.12.12-r5

Risk scores

CVSS 4.0
6
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

VendorProductVersions
wolfipython-3.130
chainguardpython-3.130
wolfipython-3.140
chainguardpython-3.100
wolfipython-3.100
chainguardpython-3.140
wolfipython-3.110
wolfipython-3.120
chainguardpython-3.110
chainguardpython-3.120

Timeline

  • Jan 23, 2026 CVE Published
  • Apr 10, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-jh94-8q48-f3m3
vulnetix vdb fixes GHSA-jh94-8q48-f3m3

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-jh94-8q48-f3m3/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›