This vulnerability arises during the process of address list folding in CPython's email handling. When a separating comma ends a folded line that is then unicode-encoded, the comma itself is also unicode-encoded, contrary to expected behavior where the comma should remain plain. This can lead to misinterpretation of the address header by some mail servers. The issue is classified under CWE-116 (Improper Encoding or Escaping of Output). The CVSS 4.0 base score is 2.3, reflecting low severity with network attack vector, high attack complexity, and low impact on confidentiality, integrity, and availability.

The impact is limited to potential misinterpretation of email address headers by some mail servers due to incorrect encoding of separating commas in folded address lists. This may affect email processing but does not directly compromise system confidentiality, integrity, or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until an official fix is released, users should be aware of this behavior when handling email address headers in affected CPython versions. No specific workaround or temporary fix is provided at this time.