Reject control characters in IMAP commands #143921

Activity

1. sethmlarson

   added

   type-securityA security issueA security issue

   on Jan 16, 2026
2. sethmlarson

   added a commit that references this issue on Jan 16, 2026

   pythongh-143921: Disallow control characters in IMAP commands

   997a64a
3. StanFromIreland

   added

   stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

   on Jan 16, 2026
4. bitdancer commented on Jan 16, 2026

   

   bitdancer

   on Jan 16, 2026

   Member

   More actions

   If there is someone familiar enough with IMAP to review this, please do.

   Otherwise I need a bit more detail, since I'm not that familiar with IMAP, and both the RFC and the code are quite complex. Can you cover how the RFC makes non-printables (other than space) illegal in 'commands', and how that relates to the imaplib implementation of _command? I scanned the RFC and code for a bit, and while my gut says your PR is correct, it isn't obvious by any means.
5. sethmlarson

   added a commit that references this issue on Jan 20, 2026

   gh-143921: Reject control characters in IMAP commands

   6262704
6. frenzymadness

   added 2 commits that reference this issue on Jan 30, 2026

   00474: CVE-2025-15366

   ...

   ce8d58f

   00474: CVE-2025-15366

   ...

   871d333
7. hroncok

   added a commit that references this issue on Feb 3, 2026

   00474: CVE-2025-15366

   ...

   3b1b4dd
8. hrnciar

   added 6 commits that reference this issue on Feb 6, 2026

   00474: CVE-2025-15366

   ...

   6069400

   00474: CVE-2025-15366

   ...

   905ce57

   00474: CVE-2025-15366

   ...

   6ea0d1b

   00474: CVE-2025-15366

   ...

   d8dc9d2

   00474: CVE-2025-15366

   ...

   8424936

   00474: CVE-2025-15366

   ...

   03de9d1
9. bmwiedemann

   added a commit that references this issue on Feb 13, 2026

   Update python310 to version 3.10.19 / rev 71 via SR 1332783

   ...

   5585b8b
10. 14 remaining items

    Load more
11. serhiy-storchaka

    added 4 commits that reference this issue on Jul 5, 2026

    gh-143921: Narrow the control character check in imaplib commands (GH…

    ...

    d0921ef

    [3.15] gh-143921: Narrow the control character check in imaplib comma…

    ...

    f2cd7ef

    [3.14] gh-143921: Reject NUL, CR and LF in IMAP commands (GH-143922, G…

    ...

    2981822

    [3.13] gh-143921: Reject NUL, CR and LF in IMAP commands (GH-143922, G…

    ...

    71926d9
12. sethmlarson

    closed this as completedon Jul 28, 2026
13. befeleme

    added 3 commits that reference this issue on Aug 18, 2026

    00474: CVE-2025-15366

    ...

    12f2b22

    00474: CVE-2025-15366

    ...

    91d8f51

    00474: CVE-2025-15366

    ...

    a19d8b5
14. caruccio commented on Sep 17, 2026

    

    caruccio

    on Sep 17, 2026

    More actions

    Hi there. Is this fix planned for 3.10, 3.11 or 3.12?
15. hrnciar

    added a commit that references this issue on Oct 1, 2026

    00474: CVE-2025-15366

    ...

    b09443e
16. hroncok

    added 3 commits that reference this issue on Oct 1, 2026

    00474: CVE-2025-15366

    ...

    6e19656

    00474: CVE-2025-15366

    ...

    6d36d50

    00474: CVE-2025-15366

    ...

    805b0ad
17. hrnciar

    added a commit that references this issue on Oct 5, 2026

    00474: CVE-2025-15366

    ...

    e7fa8c2
18. hroncok

    added a commit that references this issue on Oct 23, 2026

    00474: CVE-2025-15366

    ...

    d157bfc