- CVE-2026-0864: normalize CR and CRLF line endings when writing multi-line values in ConfigParser - RawConfigParser.write() escaped only '\n' (to '\n\t'), so an attacker-controlled value containing a bare carriage return was written out verbatim and injected unexpected keys and values into the resulting configuration file. Applied at both write() call sites, for the DEFAULT section and for named sections; Python 2.7 has no _write_section(). Backported from upstream CPython (gh-143927, GH-143929).