CVE-2025-15367 is a command injection vulnerability in the poplib module of the Python standard library, affecting Red Hat Hardened Images RPMs for python3.14. The poplib module fails to reject control characters (e.g., newlines) in user input passed to POP3 commands, enabling attackers with privileges to send POP3 commands to inject additional commands. This can manipulate mailbox state, such as deleting emails or reading metadata, but does not allow arbitrary code execution or OS command injection. Red Hat released a security advisory RHSA-2026:5994 with updated python3.14 RPMs addressing this issue. The vulnerability is tracked under CWE-77 (Improper Neutralization of Special Elements used in a Command).

An attacker with the ability to send POP3 commands can inject additional commands due to improper input sanitization, potentially manipulating mailbox state (e.g., deleting emails) and accessing email metadata or specific content. The vulnerability does not allow arbitrary code execution or operating system command injection. The impact is rated moderate due to the need for privileges to send POP3 commands and the limited scope of the attack.

Red Hat has released updated python3.14 RPM packages as part of Red Hat Hardened Images to address this vulnerability. Users should apply these updates to remediate the issue. Additionally, ensure that no data passed to the poplib module contains newline or carriage return characters to mitigate the vulnerability. Since a fix is available, applying the official update is the recommended remediation.