Unicode Encoding Vulnerability in Python Packages: CVE-2025-1795
Summary
UBUNTU-CVE-2025-1795: During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Affects python3.4 versions 3.4.0-1 – 3.4~rc3-0ubuntu1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. The affected packages, including python3.4, python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, and python3.11, are essential components of the Python ecosystem, providing various functionalities for developers. This vulnerability arises from an issue in address list folding, which can lead to incorrect handling of email headers.
Vulnerability Detail
The vulnerability, identified as CVE-2025-1795, occurs during the process of address list folding when a separating comma is placed on a folded line that is to be unicode-encoded. Instead of remaining a plain comma, the separator is also unicode-encoded, which can cause the address header to be misinterpreted by some mail servers. This misinterpretation can lead to email delivery issues, potentially affecting communication and data integrity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using unicode encoding for address headers until the packages are updated. This may involve modifying the code that handles email address formatting to ensure that commas remain plain and are not subject to unicode encoding.
Conclusion
CVE-2025-1795 presents a significant risk to Python applications that handle email address headers. By understanding the nature of this vulnerability and taking appropriate steps to update affected packages, developers can safeguard their applications against potential misinterpretation issues.
See every vulnerability recorded for python3.4 →
FAQ
CVE-2025-1795 is a vulnerability in various Python packages that affects how email address headers are processed, potentially leading to misinterpretation by mail servers.
The affected versions include python3.4, python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, and python3.11.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to email delivery issues due to misinterpretation of address headers, which may affect communication and data integrity.
Yes, patches are available for the affected Python packages. It is recommended to update to the latest patched versions to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for python3.4.
