email.headerregistry.Address rejects CR and LF in its arguments (Lib/email/headerregistry.py), but the legacy email.utils.formataddr() passes them straight into the returned header string:

>>> from email.utils import formataddr
>>> formataddr(("Alice\r\nBcc: eve@example.com", "alice@example.com"))
'"Alice\r\nBcc: eve@example.com" <alice@example.com>'
>>> formataddr(("Alice", "alice@example.com\r\nSubject: spoofed"))
'Alice <alice@example.com\r\nSubject: spoofed>'

formataddr() is documented as producing a value suitable for a From/To/Cc header and is often used to build header strings directly, so it should reject CR/LF the same way Address does.

Linked PRs

• gh-150479: reject CR and LF in email.utils.formataddr #150480