python -- several security vulnerabilities

2026-02-04 · CVE-2026-1299, CVE-2026-0865 · VuXML entry

The Python project announces a new release with several security fixes: CVE-2026-1299: gh-144125: BytesGenerator will now refuse to serialize (write) headers that are unsafely folded or delimited; see verify_generated_headers. (Contributed by Bas Bloemsaat and Petr Viktorin in gh-121650). gh-143935: Fixed a bug in the folding of comments when flattening an email message using a modern email policy. Comments …

Affected versions

• python310 < 3.10.19_2
• python311 < 3.11.14_2
• python312 < 3.12.12_4
• python313 < 3.13.12
• python313t < 3.13.12
• python314 < 3.14.3

By system

5 still vulnerable, 6 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.