CVE-2026-0864

EUVD-2026-38554
When using the "configparser" module to write configuration files
containing multi-line text values with carriage return characters (\r) the
resulting file could be injected with unexpected keys and values if the
attacker controls the written value.
Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
PSFCNA
4.1 MEDIUM
LOCAL
LOW
HIGH
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 2.8%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
pythoncpython
𝑥
< 3.13.15
CNA
pythoncpython
3.14.0 ≤
𝑥
< 3.14.7
CNA
Debian logo
Debian Releases
Debian Product
Codename
pypy3
bookworm
postponed
bullseye
postponed
bullseye (security)
vulnerable
forky
vulnerable
sid
vulnerable
trixie
no-dsa
python2.7
bullseye
vulnerable
python3.11
bookworm
postponed
bookworm (security)
vulnerable
python3.13
forky
vulnerable
sid
vulnerable
trixie
no-dsa
python3.14
forky
vulnerable
sid
vulnerable
python3.9
bullseye
postponed
bullseye (security)
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
python2.7
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
dne
questing
dne
resolute
dne
trusty
needs-triage
xenial
needs-triage
python3.4
jammy
dne
noble
dne
questing
dne
resolute
dne
trusty
needs-triage
python3.5
jammy
dne
noble
dne
questing
dne
resolute
dne
trusty
needs-triage
xenial
needs-triage
python3.6
bionic
needs-triage
jammy
dne
noble
dne
questing
dne
resolute
dne
python3.7
bionic
needs-triage
jammy
dne
noble
dne
questing
dne
resolute
dne
python3.8
bionic
needs-triage
focal
needs-triage
jammy
dne
noble
dne
questing
dne
resolute
dne
python3.9
focal
needs-triage
jammy
dne
noble
dne
questing
dne
resolute
dne
python3.10
jammy
needs-triage
noble
dne
questing
dne
resolute
dne
python3.11
jammy
needs-triage
noble
dne
questing
dne
resolute
dne
python3.12
jammy
dne
noble
needs-triage
questing
dne
resolute
dne
python3.13
jammy
dne
noble
dne
questing
ignored
resolute
dne
python3.14
jammy
dne
noble
dne
questing
ignored
resolute
needs-triage
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
python-unversioned-command
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
python3
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
python3-debug
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
python3-devel
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
python3-idle
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
python3-libs
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
python3-test
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
python3-tkinter
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
python3.11
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.4
fixed
python3.11-debug
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.4
fixed
python3.11-debuginfo
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.4
fixed
python3.11-debugsource
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.4
fixed
python3.11-devel
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.4
fixed
python3.11-idle
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.4
fixed
python3.11-libs
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.4
fixed
python3.11-test
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.4
fixed
python3.11-tkinter
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.4
fixed
python3.12
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.4
fixed
python3.12-debug
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.4
fixed
python3.12-debuginfo
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.4
fixed
python3.12-debugsource
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.4
fixed
python3.12-devel
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.4
fixed
python3.12-idle
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.4
fixed
python3.12-libs
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.4
fixed
python3.12-test
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.4
fixed
python3.12-tkinter
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.4
fixed
python3.13
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.2
fixed
python3.13-debug
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.2
fixed
python3.13-debuginfo
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.2
fixed
python3.13-debugsource
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.2
fixed
python3.13-devel
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.2
fixed
python3.13-freethreading
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.2
fixed
python3.13-freethreading-debug
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.2
fixed
python3.13-idle
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.2
fixed
python3.13-libs
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.2
fixed
python3.13-test
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.2
fixed
python3.13-tkinter
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.2
fixed
python3.14
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.3
fixed
python3.14-debug
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.3
fixed
python3.14-debuginfo
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.3
fixed
python3.14-debugsource
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.3
fixed
python3.14-devel
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.3
fixed
python3.14-freethreading
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.3
fixed
python3.14-freethreading-debug
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.3
fixed
python3.14-freethreading-devel
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.3
fixed
python3.14-freethreading-idle
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.3
fixed
python3.14-freethreading-libs
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.3
fixed
python3.14-freethreading-test
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.3
fixed
python3.14-freethreading-tkinter
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.3
fixed
python3.14-idle
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.3
fixed
python3.14-libs
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.3
fixed
python3.14-test
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.3
fixed
python3.14-tkinter
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.3
fixed
python3.9-debuginfo
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
python3.9-debugsource
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
Common Weakness Enumeration
References
https://github.com/python/cpython/commit/0adb386f6e68eb2e73d32e19f235d012df009528
https://github.com/python/cpython/commit/5858e42c539dac8394636a6e9b30472b8994851f
https://github.com/python/cpython/commit/71f2e02a52d47417a6fd69f456346cd8aa7aca98
https://github.com/python/cpython/commit/aaf850fd333cd89e9aada03d92aaa788a6cb1bb8
https://github.com/python/cpython/commit/db4a157c790479710a1a840d7937c5c815a6f8b6
https://github.com/python/cpython/issues/143927
https://github.com/python/cpython/pull/151559
https://mail.python.org/archives/list/security-announce@python.org/thread/CV4NE6AFCRJL7XQOHX7J5TSDHUWVWGJS/