The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0664-1 advisory.

    - CVE-2025-11468: header injection when folding a long comment in an email header containing exclusively     unfoldable       characters (bsc#1257029).
    - CVE-2026-0672: HTTP header injection via user-controlled cookie values and parameters when using     http.cookies.Morsel       (bsc#1257031).
    - CVE-2026-0865: user-controlled header containing newlines can allow injecting HTTP headers     (bsc#1257042).
    - CVE-2025-15366: user-controlled command can allow additional commands injected using newlines     (bsc#1257044).
    - CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
    - CVE-2025-15367: control characters may allow the injection of additional commands (bsc#1257041).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0645-1 advisory.

    - CVE-2025-11468: header injection when folding a long comment in an email header containing exclusively     unfoldable       characters (bsc#1257029).
    - CVE-2026-0672: HTTP header injection via user-controlled cookie values and parameters when using     http.cookies.Morsel       (bsc#1257031).
    - CVE-2026-0865: user-controlled header containing newlines can allow injecting HTTP headers     (bsc#1257042).
    - CVE-2025-15366: user-controlled command can allow additional commands injected using newlines     (bsc#1257044).
    - CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
    - CVE-2025-15367: control characters may allow the injection of additional commands (bsc#1257041).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:10950 advisory.

    * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing (CVE-2025-59375)
      * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)
      * cpython: Out-of-memory when loading Plist (CVE-2025-13837)
      * cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)
      * cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)
      * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
      * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
      * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
      * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
      * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression     modules (CVE-2026-6100)
      * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API     (CVE-2026-4786)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-523:13 advisory.

    * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing (CVE-2025-59375)
      * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)
      * cpython: Out-of-memory when loading Plist (CVE-2025-13837)
      * cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)
      * cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)
      * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
      * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
      * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
      * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
      * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression     modules (CVE-2026-6100)
      * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API     (CVE-2026-4786)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-29658d2f4b advisory.

    Update to 3.11.15

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the python3 package has been released.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1062-1 advisory.

    Update to Python 3.10.20:

    - CVE-2025-6075: quadratic complexity in os.path.expandvars() (bsc#1252974).
    - CVE-2025-11468: header injection with carefully crafted inputs (bsc#1257029).
    - CVE-2025-12084: quadratic complexity in xml.minidom node ID cache clearing (bsc#1254997).
    - CVE-2025-13836: potential memory denial of service in the http.client module (bsc#1254400).
    - CVE-2025-13837: potential memory denial of service in the plistlib module (bsc#1254401).
    - CVE-2026-0672: control characters in http.cookies.Morsel fields and values (bsc#1257031).
    - CVE-2026-0865: C0 control characters within wsgiref.headers.Headers fields, values, and parameters     (bsc#1257042).
    - CVE-2026-1299: header injection when an email is serialized due to improper newline quoting     (bsc#1257181).
    - CVE-2026-2297: validation bypass via incorrectly handled hook in FileLoader (bsc#1259240).

    Changelog:

    - Update to 3.10.20:
     - gh-144125: BytesGenerator will now refuse to serialize      (write) headers that are unsafely folded or delimited; see      verify_generated_headers. (Contributed by Bas Bloemsaat and      Petr Viktorin in gh-121650) (bsc#1257181, CVE-2026-1299).
     - gh-143935: Fixed a bug in the folding of comments when      flattening an email message using a modern email policy.
     Comments consisting of a very long sequence of non-foldable      characters could trigger a forced line wrap that omitted      the required leading space on the continuation line,      causing the remainder of the comment to be interpreted as      a new header field. This enabled header injection with      carefully crafted inputs (bsc#1257029 CVE-2025-11468).
     - gh-143925: Reject control characters in data: URL media      types.
     - gh-143919: Reject control characters in http.cookies.Morsel      fields and values (bsc#1257031, CVE-2026-0672).
     - gh-143916: Reject C0 control characters within      wsgiref.headers.Headers fields, values, and parameters      (bsc#1257042, CVE-2026-0865).
     - gh-142145: Remove quadratic behavior in xml.minidom node ID      cache clearing. In order to do this without breaking      existing users, we also add the ownerDocument attribute to      xml.dom.minidom elements and attributes created by directly      instantiating the Element or Attr class. Note that this way      of creating nodes is not supported; creator functions like      xml.dom.Document.documentElement() should be used instead      (bsc#1254997, CVE-2025-12084).
     - gh-137836: Add support of the 'plaintext' element, RAWTEXT      elements 'xmp', 'iframe', 'noembed' and 'noframes', and      optionally RAWTEXT element 'noscript' in      html.parser.HTMLParser.
     - gh-136063: email.message: ensure linear complexity for      legacy HTTP parameters parsing. Patch by B?n?dikt Tran.
     - gh-136065: Fix quadratic complexity in      os.path.expandvars() (bsc#1252974, CVE-2025-6075).
     - gh-119451: Fix a potential memory denial of service in the      http.client module. When connecting to a malicious server,      it could cause an arbitrary amount of memory to be      allocated. This could have led to symptoms including      a MemoryError, swapping, out of memory (OOM) killed      processes or containers, or even system crashes      (CVE-2025-13836, bsc#1254400).
     - gh-119452: Fix a potential memory denial of service in the      http.server module. When a malicious user is connected to      the CGI server on Windows, it could cause an arbitrary      amount of memory to be allocated. This could have led to      symptoms including a MemoryError, swapping, out of memory      (OOM) killed processes or containers, or even system      crashes.
     - gh-119342: Fix a potential memory denial of service in the      plistlib module. When reading a Plist file received from      untrusted source, it could cause an arbitrary amount of      memory to be allocated. This could have led to symptoms      including a MemoryError, swapping, out of memory (OOM)      killed processes or containers, or even system crashes      (bsc#1254401, CVE-2025-13837).
     - Library
     - gh-144833: Fixed a use-after-free in ssl when SSL_new()      returns NULL in newPySSLSocket(). The error was reported      via a dangling pointer after the object had already been      freed.
     - gh-144363: Update bundled libexpat to 2.7.4
     - gh-90949: Add SetAllocTrackerActivationThreshold() and      SetAllocTrackerMaximumAmplification() to xmlparser objects      to prevent use of disproportional amounts of dynamic memory      from within an Expat parser. Patch by B?n?dikt Tran.
     - Core and Builtins
     - gh-120384: Fix an array out of bounds crash in      list_ass_subscript, which could be invoked via some      specificly tailored input: including concurrent      modification of a list object, where one thread assigns      a slice and another clears it.
     - gh-120298: Fix use-after free in list_richcompare_impl      which can be invoked via some specificly tailored evil      input.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0389 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2025-6075:
    If the value passed to os.path.expandvars() is user-controlled a     performance degradation is possible when expanding environment     variables.

    CVE-2025-13837:
    When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a     malicious file can cause OOM and DoS issues

    CVE-2025-15282:
    User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in     the data URL mediatype.

    CVE-2025-59375:
    libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing.

    CVE-2026-0672:
    When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP     headers into messages. Patch rejects all control characters within cookie names, values, and parameters.

    CVE-2026-1502:
    CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.

    CVE-2026-2297:
    The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled     in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers     for this audit event therefore do not fire.

    CVE-2026-3644:
    The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The     Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass     input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to     BaseCookie.output().

    CVE-2026-4224:
    When an Expat parser with a registered ElementDeclHandler parses an inline     document type definition containing a deeply nested content model a C stack     overflow occurs.

    CVE-2026-4786:
    Mitgation ofCVE-2026-4519 was incomplete. If the URL contained %action the mitigation could be     bypassed for certain browser types the webbrowser.open() API could have commands injected into the     underlying shell. SeeCVE-2026-4519 for details.

    CVE-2026-6100:
    Use-after-free (UAF) was possible in the lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile     when a memory allocation fails with a MemoryError and the decompression instance is re-used. This scenario     can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this     specific error condition.

    The vulnerability is only present if the program re-uses decompressor instances across multiple     decompression calls even after a MemoryError is raised during decompression. Using the helper functions to     one-shot decompress data such as lzma.decompress(), bz2.decompress(), gzip.decompress(), and     zlib.decompress() are not affected as a new decompressor instance is used per call. If the decompressor     instance is not re-used after an error condition, this usage is similarly not vulnerable.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when     expanding environment variables.(CVE-2025-6075)

    When reading an HTTP response from a server, if no read amount is specified, the default behavior will be     to use Content-Length. This allows a malicious server to cause the client to read large amounts of data     into memory, potentially causing OOM or other DoS.(CVE-2025-13836)

    When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency     on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively     nested documents.(CVE-2025-12084)

    The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator     record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would     be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that     are handled differently by the 'zipfile' module compared to other ZIP implementations.Remediation     maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the     expected value.(CVE-2025-8291)

    CPython 3.9 and earlier doesn't disallow configuring an empty list ('[]') for     SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a     buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity     due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically     a protocol name would be configured).(CVE-2024-5642)

    When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a     malicious file can cause OOM and DoS issues(CVE-2025-13837)

    The     email module, specifically the 'BytesGenerator' class, didn't properly quote newlines for email headers     when serializing an email message allowing for header injection when an email  is serialized. This is only     applicable if using 'LiteralHeader' writing headers that don't respect email folding rules, the new     behavior will reject the incorrectly folded headers in 'BytesGenerator'.(CVE-2026-1299)

    When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP     headers into messages. Patch rejects all control characters within cookie names, values, and     parameters.(CVE-2026-0672)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:19177 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing (CVE-2025-59375)

    * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

    * cpython: Out-of-memory when loading Plist (CVE-2025-13837)

    * cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)

    * cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)

    * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

    * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

    * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

    * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

    * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

    * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression     modules (CVE-2026-6100)

    * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API     (CVE-2026-4786)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:19177 advisory.

    * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing (CVE-2025-59375)

    * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

    * cpython: Out-of-memory when loading Plist (CVE-2025-13837)

    * cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)

    * cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)

    * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

    * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

    * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

    * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

    * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

    * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression     modules (CVE-2026-6100)

    * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API     (CVE-2026-4786)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
300550	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python3 (SUSE-SU-2026:0664-1)	Nessus	SuSE Local Security Checks	2026/3/4	2026/4/30	medium
300581	SUSE SLES12 Security Update : python3 (SUSE-SU-2026:0645-1)	Nessus	SuSE Local Security Checks	2026/3/4	2026/4/30	medium
310955	AlmaLinux 8 : python3.12 (ALSA-2026:10950)	Nessus	Alma Linux Local Security Checks	2026/4/29	2026/4/29	critical
311812	MiracleLinux 8 : python3.12-3.12.13-2.el8_10 (AXSA:2026-523:13)	Nessus	Miracle Linux Local Security Checks	2026/5/3	2026/5/3	critical
302347	Fedora 43 : python3.11 (2026-29658d2f4b)	Nessus	Fedora Local Security Checks	2026/3/15	2026/3/15	medium
332722	Photon OS 5.0: Python3 PHSA-2026-5.0-91-0850	Nessus	PhotonOS Local Security Checks	2026/8/5	2026/8/5	high
303953	SUSE SLES15: libpython3_10-1_0 / libpython3_10-1_0-32bit / python310 / etc (SUSE-SU-2026:1062-1)	Nessus	SuSE Local Security Checks	2026/3/27	2026/6/26	medium
316709	TencentOS Server 3: python3.12 (TSSA-2026:0389)	Nessus	Tencent Local Security Checks	2026/5/26	2026/6/5	critical
319467	EulerOS Virtualization 2.13.1 : python3 (EulerOS-SA-2026-2149)	Nessus	Huawei Local Security Checks	2026/6/6	2026/6/6	medium
315485	RHEL 9 : python3.12 (RHSA-2026:19177)	Nessus	Red Hat Local Security Checks	2026/5/19	2026/6/10	critical
317440	RockyLinux 9 : python3.12 (RLSA-2026:19177)	Nessus	Rocky Linux Local Security Checks	2026/5/28	2026/6/5	critical

检测

插件搜索

medium

medium

critical

critical

medium

high

medium

critical

medium

critical

critical