CVE-2023-27043

What it actually does

The email module in Python incorrectly parses addresses containing special characters by misidentifying the addr-spec portion of RFC2822 headers in email/_parseaddr.py, allowing an attacker-supplied value from an arbitrary domain to be treated as valid.

Why it matters to the business

Applications that gate access or registration on verified email domains can be bypassed, resulting in unauthorized account creation or access without requiring changes to infrastructure or credentials.

How an attack unfolds

An attacker supplies a crafted email address containing special characters that causes the Python parser to extract an addr-spec from the wrong header segment; the application then accepts the address as belonging to an allowed domain, granting access or registration.

How to fix it

Upgrade Python to a build containing commit a4a2d2b0d85273f746c3834ce2753e19c898949d or later; re-test any custom email address validation logic after the upgrade.

How to confirm the fix worked

Replay known malicious addresses containing special characters against the updated email parser and confirm that only the correct addr-spec from an allowed domain is extracted.

Typical attack path

1. Identify an application that uses Python's email module to validate incoming addresses against a domain allow-list
2. Craft an address containing special characters that shifts the parsed addr-spec to an attacker-controlled domain
3. Submit the address during signup or authentication flow
4. Receive successful validation and obtain unauthorized access or account

How to detect it

Review application logs for email address validation events that succeed with addresses containing unusual characters or mixed domains; correlate with signup or authentication attempts from unexpected sources.

What your security team should do

• Apply the Python fix commit a4a2d2b0d85273f746c3834ce2753e19c898949d across all affected environments
• Audit code that relies on email address domain checks for access control and add secondary validation
• Monitor EPSS and exploit availability trends for this issue to adjust patching priority