This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-0864 →
ALPINE-CVE-2026-0864
When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting...
Original description
The description as published by the source.
When using the "configparser" module to write configuration files
containing multi-line text values with carriage return characters (\r) the
resulting file could be injected with unexpected keys and values if the
attacker controls the written value.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Alpine:v3.21
python3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.14-r0"}]}]
Alpine:v3.22
python3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.14-r0"}]}]
Alpine:v3.23
python3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.14-r0"}]}]
Alpine:v3.24
python3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.7-r0"}]}]
References
- advisory security.alpinelinux.org