{"id":"PSF-2019-16","aliases":[],"status":"published","title":"Email header injection in Address objects","description":"It is possible to inject email headers using CR or LF character.\n\nThe fix disallows CR and LF characters in ``email.headerregistry.Address``\narguments to guard against header injection attacks.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2019-12-17T00:00:00Z","modified":"2025-10-09T01:00:02Z","references":[{"url":"https://bugs.python.org/issue39073","tags":["report"]}],"sources":{"osv":[{"id":"PSF-2019-16","title":"Email header injection in Address objects","description":"It is possible to inject email headers using CR or LF character.\n\nThe fix disallows CR and LF characters in ``email.headerregistry.Address``\narguments to guard against header injection attacks.\n","status":"published","published":"2019-12-17T00:00:00Z","modified":"2025-10-09T01:00:02.15663Z","updated_at":"2026-11-02T15:52:50.263679Z"}]}}