The HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and input HTML tags. Xwiki commons is the common modules used by other XWiki top level projects.
The email package is intended to have size limits and to throw an exception when limits are exceeded they were exceeded by the example demonstration code.
NOTE: the vendor's perspective is that this is neither a vulnerability nor a bug. Applications should instead use the or class. NOTE: is categorized as a Legacy API in the documentation of the Python email package. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. ** DISPUTED ** The legacy function in Python through 3.11.4 allows attackers to trigger 'RecursionError: maximum recursion depth exceeded while calling a Python object' via a crafted argument.
