CVE-2025-1795

Comma in folded address list line incorrectly unicode-encoded.

• CVSS 2.3
• CWE-116
• Input Validation and Sanitization
• Remote

During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers.

CVE

CVE-2025-1795

CWE

CWE-116

CVSS base score

2.3

Published

2025-02-28

OWASP

A03:2021-Injection

Orthogonal defect classification

Interface

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

Python

Fixed by upgrading

Yes

Solution

Upgrade to Exim version 4.96.2 or later.

import email.header
import email.utils

def address_folding(display_name, email_address, charset='utf-8'):
    
    full_address = email.utils.formataddr((display_name, email_address))
    header_value = email.header.Header(full_address, charset)

    encoded_header = str(header_value)

    print("Encoded Header (Potential Vulnerability):", encoded_header)

if __name__ == '__main__':
    display_name = "Some User with Unicode Name ������"
    email_address = "user@example.com"
    address_folding(display_name, email_address)


    display_name = "VeryLongNameWithUnicodeCharacters ������ that causes folding"
    email_address = "user@example.com"
    address_folding(display_name, email_address)

import email.header
import email.utils

def address_folding(header_value, charset='utf-8'):
  
  addresses = email.utils.getaddresses([header_value])
  encoded_addresses = []
  for name, addr in addresses:
    if name:
      h = email.header.Header(name, charset)
      encoded_name = str(h)
      encoded_address = email.utils.formataddr((encoded_name, addr))
    else:
      encoded_address = addr
    encoded_addresses.append(encoded_address)

  return ', '.join(encoded_addresses)

if __name__ == '__main__':
    display_name = "Some User with Unicode Name ������"
    email_address = "user@example.com"
    address_folding(display_name, email_address)


    display_name = "VeryLongNameWithUnicodeCharacters ������ that causes folding"
    email_address = "user@example.com"
    address_folding(display_name, email_address)

To: test,=
 user@example.com

@misc{vaitp:cve20251795,
  title        = {{Comma in folded address list line incorrectly unicode-encoded.
}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2025},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2025-1795},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2025-1795/}}
}