The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-095:01 advisory.

    * cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service     (CVE-2025-12084)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:1620 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service     (CVE-2025-12084)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8018-1 advisory.

    Denis Ledoux discovered that Python incorrectly parsed email message headers. An attacker could possibly     use this issue to inject arbitrary headers into email messages. This issue only affected python3.6,     python3.7, python3.8, python3.9, python3.10, python3.11, python3.12, python3.13, and python3.14 packages.
    (CVE-2025-11468)

    Jacob Walls, Shai Berger, and Natalia Bidart discovered that Python inefficiently parsed XML input with     quadratic complexity. An attacker could possibly use this issue to cause a denial of service.
    (CVE-2025-12084)

    It was discovered that Python incorrectly parsed malicious plist files. An attacker could possibly use     this issue to cause Python to use excessive resources, leading to a denial of service. This issue only     affected python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12,     python3.13, and python3.14 packages. (CVE-2025-13837)

    Omar Hasan discovered that Python incorrectly parsed URL mediatypes. An attacker could possibly use this     issue to inject arbitrary HTTP headers. (CVE-2025-15282)

    Omar Hasan discovered that Python incorrectly parsed malicious IMAP inputs. An attacker could possibly use     this issue to inject arbitrary IMAP commands. (CVE-2025-15366)

    Omar Hasan discovered that Python incorrectly parsed malicious POP3 inputs. An attacker could possibly use     this issue to inject arbitrary POP3 commands. (CVE-2025-15367)

    Omar Hasan discovered that Python incorrectly parsed malicious HTTP cookie headers. An attacker could     possibly use this issue to inject arbitrary HTTP headers. (CVE-2026-0672)

    Omar Hasan discovered that Python incorrectly parsed malicious HTTP header names and values. An attacker     could possibly use this issue to inject arbitrary HTTP headers. (CVE-2026-0865)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:2391 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service     (CVE-2025-12084)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-dd37d41d7f advisory.

    Security fix for CVE-2025-12084


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1769510460 advisory.

  - When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency     on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively     nested documents. (CVE-2025-12084)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1769621572 advisory.

  - When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency     on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively     nested documents. (CVE-2025-12084)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1430 advisory.

    This advisory aggregates security fixes for the python3.9 SRPM in CIQ LTS 9.6. It addresses 9 CVEs:
    CVE-2025-12084, CVE-2024-5642, CVE-2025-6075, CVE-2025-4516, CVE-2026-0672, and 4 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1349-1 advisory.

    - Updated to Python 3.11.15
    - CVE-2025-6075: If the value passed to os.path.expandvars() is user-controlled a performance degradation     is possible when expanding environment variables (bsc#1252974).
    - CVE-2025-11468: header injection when folding a long comment in an email header containing exclusively     unfoldable characters (bsc#1257029).
    - CVE-2025-12084: cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of     service (bsc#1254997).
    - CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined     (bsc#1259611).
    - CVE-2025-13836: When reading an HTTP response from a server, if no read amount is specified, the default     behavior will be to use Content-Length (bsc#1254400).
    - CVE-2025-13837: When loading a plist file, the plistlib module reads data in size specified by the file     itself, meaning a malicious file can cause OOM and DoS issues (bsc#1254401).
    - CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
    - CVE-2026-0672: HTTP header injection via user-controlled cookie values and parameters when using     http.cookies.Morsel (bsc#1257031).
    - CVE-2026-0865: user-controlled header containing newlines can allow injecting HTTP headers     (bsc#1257042).
    - CVE-2026-1299: header injection when an email is serialized due to improper newline quoting in     `BytesGenerator` (bsc#1257181).
    - CVE-2026-2297: cpython: incorrectly handled hook in FileLoader can lead to validation bypass     (bsc#1259240).
    - CVE-2026-3479: python: improper resource argument validation can allow path traversal (bsc#1259989).
    - CVE-2026-3644: incomplete control character validation in http.cookies (bsc#1259734).
    - CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).
    - CVE-2026-4519: leading dashes in URLs are accepted by the `webbrowser.open()` API and allow for web     browser command line option injection (bsc#1260026).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
297078	MiracleLinux 9 : python3.9-3.9.25-3.el9_7 (AXSA:2026-095:01)	Nessus	Miracle Linux Local Security Checks	2026/1/29	2026/1/29	medium
297514	RHEL 8 : python3 (RHSA-2026:1620)	Nessus	Red Hat Local Security Checks	2026/2/2	2026/2/2	medium
298266	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : Python vulnerabilities (USN-8018-1)	Nessus	Ubuntu Local Security Checks	2026/2/6	2026/4/30	medium
298490	RHEL 8 : python3 (RHSA-2026:2391)	Nessus	Red Hat Local Security Checks	2026/2/10	2026/2/10	medium
302492	Fedora 42 : python3.6 (2026-dd37d41d7f)	Nessus	Fedora Local Security Checks	2026/3/16	2026/3/16	medium
352131	CentOS Linux 8.4 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc (CENTOS8.4:CLSA-2026:1769510460)	Nessus	CentOS Local Security Checks	2026/9/30	2026/9/30	medium
361560	CentOS Linux 8 [TuxCare] Security Update: python2 / python2-debug / python2-devel / python2-libs / etc (CENTOS-STREAM8:CLSA-2026:1769621572)	Nessus	CentOS Local Security Checks	2026/10/1	2026/10/1	medium
353710	Rocky Linux 9.6 [CIQ] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (ciqsa-2026_1430)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
306693	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python311 (SUSE-SU-2026:1349-1)	Nessus	SuSE Local Security Checks	2026/4/16	2026/4/16	high

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

high

high