Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-23T17:42:01 python: cpython: Python configparser: Configuration injection via crafted multi-line input 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CWE-93

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.

A flaw was found in the Python `configparser` module. When writing configuration files, an attacker who controls the input value can inject unexpected keys and values. This occurs if the input contains multi-line text with carriage return characters, leading to potential configuration manipulation.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Enterprise Linux 8 Fix deferred python36 https://www.cve.org/CVERecord?id=CVE-2026-0864 https://nvd.nist.gov/vuln/detail/CVE-2026-0864 https://github.com/python/cpython/commit/5858e42c539dac8394636a6e9b30472b8994851f https://github.com/python/cpython/issues/143927 https://github.com/python/cpython/pull/151559 https://mail.python.org/archives/list/security-announce@python.org/thread/CV4NE6AFCRJL7XQOHX7J5TSDHUWVWGJS/