CVE-2026-0864

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.

• CWE-74

• https://github.com/python/cpython/commit/0adb386f6e68eb2e73d32e19f235d012df009528Patch
• https://github.com/python/cpython/commit/12dcbd74d3563016a8cb8c47e4898889f34f74ddPatch
• https://github.com/python/cpython/commit/274de100bbf4345bd0c23ef5b446722e9e636908Patch
• https://github.com/python/cpython/commit/5858e42c539dac8394636a6e9b30472b8994851fPatch
• https://github.com/python/cpython/commit/71f2e02a52d47417a6fd69f456346cd8aa7aca98Patch
• https://github.com/python/cpython/commit/aaf850fd333cd89e9aada03d92aaa788a6cb1bb8Patch
• https://github.com/python/cpython/commit/db4a157c790479710a1a840d7937c5c815a6f8b6Patch
• https://github.com/python/cpython/issues/143927Issue Tracking, Patch
• https://github.com/python/cpython/pull/151559Issue Tracking, Patch
• https://mail.python.org/archives/list/security-announce@python.org/thread/CV4NE6AFCRJL7XQOHX7J5TSDHUWVWGJS/Mailing List, Vendor Advisory

Published

Jun 23, 2026

Last Modified

Aug 18, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-0858Versions of the package net.sourceforge.plantuml:plantuml be…6.1
• CVE-2026-0859TYPO3's mail‑file spool deserialization flaw lets local user…7.8
• CVE-2026-0860Exposure of Sensitive Information to an Unauthorized Actor v…7.5
• CVE-2026-0861Passing too large an alignment to the memalign suite of func…8.4
• CVE-2026-0862The Save as PDF Plugin by PDFCrowd plugin for WordPress is v…6.1
• CVE-2026-0863Using string formatting and exception handling, an attacker …9.9
• CVE-2026-0865User-controlled header names and values containing newlines …5.9
• CVE-2026-0866Rejected reason: After the publication of the PoC by the res…
• CVE-2026-0867The Essential Widgets plugin for WordPress is vulnerable to …6.4
• CVE-2026-0868The EMC – Easily Embed Calendly Scheduling Features plugin f…6.4
• CVE-2026-0869Authentication bypass in Brocade ASCG 3.4.0 Could allow an u…8.8
• CVE-2026-0870MacroHub developed by GIGABYTE has a Local Privilege Escalat…8.5