Would someone familiar with the email package be able to review these two security-related PRs?
- gh-80222: Fix email address header folding with long quoted-string by medmunds · Pull Request #122753 · python/cpython · GitHub
- gh-121284: Fix email address header folding with parsed encoded-word by medmunds · Pull Request #122754 · python/cpython · GitHub
Both fix problems in the modern email API related to email.policy.default’s refolding of email address headers. PSRT has examples of plausible attack vectors.
Also, while I’m asking, these two other email PRs have been waiting for reviews. (But these are just ordinary bug fixes; the ones above are higher priority.)