It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1774 advisory.

    The tarfile module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while     processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a     crafted tar archive being misinterpreted by the tarfile module compared to other implementations.
    (CVE-2025-13462)

    CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. (CVE-2026-1502)

    The profiling.sampling module (Python 3.15+) and asyncio introspection capabilities (3.14+, python -m     asyncio ps and python -m asyncio pstree) features could be used to read and write addresses in a     privileged process if that process connected to a malicious or infected Python process via the remote     debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be     exploited, even after the connecting process crashes with high likelihood due to ASLR. (CVE-2026-5713)

    http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes  for JavaScript     string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated     script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
    (CVE-2026-6019)

    `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding     protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this     vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch. (CVE-2026-7210)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3635-1 advisory.

    - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when     the       `configparser` module is used (bsc#1269066).
    - CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting     maliciously       crafted wheel archives (bsc#1257599).
    - CVE-2026-3219: python-pip: pip doesn't reject concatenated ZIP (bsc#1262467).
    - CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing     specially crafted       Unicode input (bsc#1267581).
    - CVE-2026-6357: pip self-update functionality can import newly installed modules after wheel installation     (bsc#1263442       bsc#1263443).
    - CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-     flooding       protection (bsc#1264962).
    - CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address     (bsc#1265268).
    - CVE-2026-8643: Path traversal via malicious entry point name in pip wheel installation allows arbitrary     file overwrite       (bsc#1266669).
    - CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead     to DoS       (bsc#1269788).
    - CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup     declarations       (bsc#1271192).
    - Regression in `http.cookies` (bsc#1263083).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dfc9182263 advisory.

    New Python version including bugfixes and security fixes.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input     containing long runs of combining characters with alternating Canonical Combining Class values.This     affects all normalization forms.(CVE-2026-3276)

    tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a     hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback     validated the symlink at its archived location but recreated it at the hardlink's shallower path, letting     a relative target the filter judged contained escape the destination directory. This allowed a malicious     tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads     or writes. This was an incomplete fix of CVE-2025-4330.(CVE-2026-11940)

    When calling base64.b64decode() or related functions the decoding process would stop after encountering     the first padded quad regardless of whether there was more information to be processed. This can lead to     data being accepted which may be processed differently by other implementations. Use 'validate=True' to     enable stricter processing of base64 data.(CVE-2026-3446)

    In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks.
    An affected system that extracts content from untrusted tar files could end up writing files with an     unexpected uid/gid despite the user passing filter='data' to the extract() function.(CVE-2026-4360)

    The imaplib module, when passed a user-controlled command, can have additional commands injected using     newlines. Mitigation rejects commands containing control characters.(CVE-2025-15366)

    To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the     VPATH variable is defined at build time and used to locate certain landmarks -     specifically,Modules/setup.local. When this landmark is found relative to VPATH     relative to the executable, Python assumes it is running in a source tree and generates a different     default sys.path. This code remains in release builds, so that release-ready builds can be built in-     tree.On Windows, since builds are written to 'PCbuild/', the value of     VPATH is set to '..\..', which results in a landmark of '..\..\Modules\setup.local'. This path is outside     the install directory of Python, and may have different permissions, potentially allowing a low-privilege     user to create the landmark and an alternative `Lib` folder that will be discovered by an otherwise     restricted install.Such a setup occurs with the legacy default install location for all users (in the now     superseded EXE installer), due to how Windows allows all users to create folders in the root directory of     their OS drive.Our recommended mitigation on Windows is to migrate away from the legacy installer and use     the new [Python install manager](https://www.python.org/downloads/latest/pymanager/) to install for the     current user. Installs where the directory two levels above the     Python installation directory have equivalent permissions are unaffected (in general, a per-user install     cannot be modified at all by other users, removing any escalation of privilege risk, and could be directly     modified by a privileged user, making the potential tampering irrelevant). Alternative mitigations might     include preemptively creating and restricting access to a `Modules` directory. Be aware that only 3.13 and     3.14 will receive updated legacy installers - earlier fixes are only provided as sources.Platforms other     than Windows allow VPATH to be overridden, but as they don't usually use a separated directory in the     build for binaries, are unlikely to have a landmark reference outside of the install directory.The     landmark detection involving VPATH is a fallback for when a more     specific landmark - .\pybuilddir.txt - is absent, and was included for compatibility. Future releases of     Python will no longer include the fallback, and so builds will need to generate or preserve the     pybuilddir.txt file in order to work in-tree. This landmark file has     been generated on Windows since 3.11, and on other platforms for longer.(CVE-2026-12003)

    `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding     protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this     vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.(CVE-2026-7210)

    When using the 'configparser' module to write configuration files containing multi-line text values with     carriage return characters (\r) the resulting file could be injected with unexpected keys and values if     the attacker controls the written value.(CVE-2026-0864)

    When using the 'tarfile' module with a file opened in 'streaming mode' (mode='r|') the tarfile module did     not properly handle EOF, making archive parsing take exponentially longer.(CVE-2026-11972)

    The Oracle Solaris Third Party Bulletin announces patches for one or more security vulnerabilities     addressed in third party software that is included in Oracle Solaris distributions. Starting January 20,     2015, Third Party Bulletins are released on the same day when Oracle Critical Patch Updates are released.
    These bulletins will also be updated after their release between the quarterly Critical Patch Updates. In     addition, Third Party Bulletins may also be updated for vulnerability issues deemed too critical to wait     for the next monthly update.(CVE-2026-8328)

    The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated     unterminated markup declarations when processing uncontrolled data.(CVE-2026-15308)

    bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data.(CVE-2026-9669)

    tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process.(CVE-2026-7774)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
319867	Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-1774)	Nessus	Amazon Linux Local Security Checks	2026/6/8	2026/6/8	medium
337990	SUSE SLES15: libpython2_7-1_0 / python / python-base / python-curses / etc (SUSE-SU-2026:3635-1)	Nessus	SuSE Local Security Checks	2026/8/19	2026/9/3	high
321848	Fedora 44 : python3.13 (2026-dfc9182263)	Nessus	Fedora Local Security Checks	2026/6/21	2026/6/21	critical
377402	EulerOS Virtualization 2.15.0 : python3 (EulerOS-SA-2026-4849)	Nessus	Huawei Local Security Checks	2026/11/7	2026/11/7	high

検出

プラグインの検索

medium

high

critical

high