CVE-2026-0864

A flaw was found in the Python configparser module. When writing configuration files, an attacker who controls the input value can inject unexpected keys and values. This occurs if the input contains multi-line text with carriage return characters, leading to potential configuration manipulation.

This flaw in the Python configparser module allows for configuration injection. When an application utilizes configparser to write multi-line input containing carriage return characters that are controlled by an attacker, arbitrary keys and values can be injected into the configuration file. This risk is present only in applications that process and write untrusted multi-line input directly to configuration files.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.