Servers and applications
CVE-2026-0864
When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.
- Severity
- Medium 4.1
- Published
- 23 Jun 2026
- Last changed
- 18 Aug 2026
- Added to UpHeron
- 21 Oct 2026
- Fixed in
- 3.10.21, 3.11.16, 3.12.14, 3.13.15, 3.14.7
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
PythonServers and applications · cpe:a:python:python |
All 16 release lines
|