All vulnerabilities

Servers and applications

CVE-2026-0864

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.

Severity
Medium 4.1
Published
23 Jun 2026
Last changed
18 Aug 2026
Added to UpHeron
21 Oct 2026
Fixed in
3.10.21, 3.11.16, 3.12.14, 3.13.15, 3.14.7
Sources
NVD

Affected software

SoftwareAffected versions
PythonServers and applications · cpe:a:python:python
  • Version 3.15.0-beta3
  • Version 3.15.0-beta2
  • Version 3.15.0-beta1
  • Version 3.15.0-alpha8
All 16 release lines
  • Every version before 3.10.21
  • From 3.11.0 before 3.11.16
  • From 3.12.0 before 3.12.14
  • From 3.13.0 before 3.13.15
  • From 3.14.0 before 3.14.7
  • Version 3.15.0-alpha1
  • Version 3.15.0-alpha2
  • Version 3.15.0-alpha3
  • Version 3.15.0-alpha4
  • Version 3.15.0-alpha5
  • Version 3.15.0-alpha6
  • Version 3.15.0-alpha7
  • Version 3.15.0-alpha8
  • Version 3.15.0-beta1
  • Version 3.15.0-beta2
  • Version 3.15.0-beta3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-0864
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-0864