Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.

microsoft_mariner CVE-2024-12254: CVE-2024-12254

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-9442:17 advisory.

    * python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287)
      * python: Unbounded memory buffering in SelectorSocketTransport.writelines() (CVE-2024-12254)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-9392:15 advisory.

    * python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287)
      * python: Unbounded memory buffering in SelectorSocketTransport.writelines() (CVE-2024-12254)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2025 CPU advisory.

  - Vulnerability in the SQLcl (jgit) component of Oracle Database Server. Supported versions that are     affected are 23.4-23.9. Difficult to exploit vulnerability allows low privileged attacker having Valid     account privilege with network access via HTTP to compromise SQLcl (jgit). Successful attacks require     human interaction from a person other than the attacker. Successful attacks of this vulnerability can     result in unauthorized access to critical data or complete access to all SQLcl (jgit) accessible data.
    (CVE-2025-4949)

  - Vulnerability in the RDBMS (Python) component of Oracle Database Server. Supported versions that are     affected are 21.3-21.19 and 23.4-23.9. Easily exploitable vulnerability allows low privileged attacker     having Authenticated User privilege with logon to the infrastructure where RDBMS (Python) executes to     compromise RDBMS (Python). Successful attacks require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can result in takeover of RDBMS (Python).
    (CVE-2024-12254, CVE-2024-12718, CVE-2024-6923, CVE-2024-8088, CVE-2025-1795, CVE-2025-4138,     CVE-2025-4330, CVE-2025-4435, CVE-2025-4517)

  - Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are     19.3-19.28, 21.3-21.19 and 23.4-23.9. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can     result in unauthorized creation, deletion or modification access to critical data or all Java VM     accessible data. (CVE-2025-61881)

  - Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are     affected are 19.3-19.28, 21.3-21.19 and 23.4-23.9. Easily exploitable vulnerability allows unauthenticated     attacker with network access via Bonjour to compromise Portable Clusterware. While the vulnerability is in     Portable Clusterware, attacks may significantly impact additional products (scope change). Successful     attacks of this vulnerability can result in unauthorized read access to a subset of Portable Clusterware     accessible data. (CVE-2025-53047)

  - Vulnerability in the Unified Audit component of Oracle Database Server. Supported versions that are     affected are 23.4-23.9. Easily exploitable vulnerability allows high privileged attacker having DBA     privilege with network access via Oracle Net to compromise Unified Audit. Successful attacks of this     vulnerability can result in unauthorized update, insert or delete access to some of Unified Audit     accessible data. (CVE-2025-61749)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not pause     writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the     high-water mark. Because of this, Protocols would not periodically drain the write buffer potentially     leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using     Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using     .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of     these factors are true then your usage of Python is unaffected. (CVE-2024-12254)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02074-1 advisory.

    Update to version 3.13.5.

    Security issues fixed:

    - CVE-2025-4517: arbitrary filesystem writes outside the extraction directory during extraction with     filter='data' (bsc#1244032)
    - CVE-2025-4516: use-after-free in the unicode-escape decoder when using the error handler (bsc#1243273).
    - CVE-2025-4330: extraction filter bypass for linking outside extraction directory (bsc#1244060)
    - CVE-2025-4138: may allow symlink targets to point outside the destination directory, and the     modification of some file metadata.
       (bsc#1244059)
    - CVE-2025-0938: domain names containing square brackets are not identified as incorrect by urlparse     (bsc#1236705).
    - CVE-2024-12718:  bypass extraction filter to modify file metadata outside extraction directory     (bsc#1244056)
    - CVE-2024-12254: memory exhaustion due to unbounded memory buffering in     `SelectorSocketTransport.writelines()`       (bsc#1234290).



Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0006 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-12254:
    Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not pause     writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the     high-water mark. Because of this, Protocols would not periodically drain the write buffer potentially     leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using     Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using     .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of     these factors are true then your usage of Python is unaffected.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:1116 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-9287:
    A vulnerability has been found in the CPython venv module and CLI where path names provided when creating     a virtual environment were not quoted properly, allowing the creator to inject commands into virtual     environment activation scripts (ie source venv/bin/activate). This means that attacker-controlled     virtual environments are able to run commands when the virtual environment is activated. Virtual     environments which are not created by an attacker or which aren't activated before being used (ie     ./venv/bin/python) are not affected.

    CVE-2024-12254:
    Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines()      method would not pause writing and signal to the Protocol to drain     the buffer to the wire once the write buffer reached the high-water     mark. Because of this, Protocols would not periodically drain the write      buffer potentially leading to memory exhaustion.





    This      vulnerability likely impacts a small number of users, you must be using      Python 3.12.0 or later, on macOS or Linux, using the asyncio module     with protocols, and using .writelines() method which had new     zero-copy-on-write behavior in Python 3.12.0 and later. If not all of     these factors are true then your usage of Python is unaffected.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:10978 advisory.

    * python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287)

    * python: Unbounded memory buffering in SelectorSocketTransport.writelines() (CVE-2024-12254)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0521-1 advisory.

    - CVE-2025-0938: Functions `urllib.parse.urlsplit` and `urlparse` accept domain names including square     brackets (bsc#1236705).
    - CVE-2024-12254: Unbounded memory buffering in SelectorSocketTransport.writelines() (bsc#1234290).

    Other bugfixes:

    - Position of SUSE Python interpreters on Externally managed environments (bsc#1228165).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-808 advisory.

    Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines()method would not pause     writing and signal to the Protocol to drainthe buffer to the wire once the write buffer reached the high-     watermark. Because of this, Protocols would not periodically drain the writebuffer potentially leading to     memory exhaustion.





    Thisvulnerability likely impacts a small number of users, you must be usingPython 3.12.0 or later, on     macOS or Linux, using the asyncio modulewith protocols, and using .writelines() method which had newzero-     copy-on-write behavior in Python 3.12.0 and later. If not all ofthese factors are true then your usage of     Python is unaffected. (CVE-2024-12254)

    A vulnerability has been found in the CPython `venv` module and CLI where path names provided when     creating a virtual environment were not quoted properly, allowing the creator to inject commands into     virtual environment activation scripts (ie source venv/bin/activate). This means that attacker-     controlled virtual environments are able to run commands when the virtual environment is activated.
    Virtual environments which are not created by an attacker or which aren't activated before being used (ie     ./venv/bin/python) are not affected. (CVE-2024-9287)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS / 24.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7219-1 advisory.

    It was discovered that Python incorrectly handled asyncio write buffers. A remote attacker could possibly     use this issue to cause Python to consume memory, leading to a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-82a696ca59 advisory.

    Update to 3.12.8




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-3c18fe0d93 advisory.

    This is the first maintenance release of Python 3.13     ====================================================

    Python 3.13 is the newest major release of the Python programming language, and it contains many new     features and optimizations compared to Python 3.12. 3.13.1 is the latest maintenance release, containing     almost 400 bugfixes, build improvements and documentation changes since 3.13.0.

    Security content in this release
    --------------------------------

    -   [gh-122792](https://github.com/python/cpython/issues/122792): Changed IPv4-mapped     `ipaddress.IPv6Address` to consistently use the mapped IPv4 address value for deciding properties.
    Properties which have their behavior fixed are `is_multicast`, `is_reserved`, `is_link_local`,     `is_global`, and `is_unspecified`.
    -   CVE-2024-9287: [gh-124651](https://github.com/python/cpython/issues/124651): Properly quote template     strings in `venv` activation scripts.
    -   [gh-125140](https://github.com/python/cpython/issues/125140): Remove the current directory from     sys.path when using PyREPL.
    - CVE-2024-12254: Unbounded memory buffering in `SelectorSocketTransport.writelines()` fixed.

    libdnf and libcomps fixes     ====================

    - Fix segfaults in iterators (Python 3.13.1 made this crash happen in regular usage)






Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-be6ea1ce44 advisory.

    This is the first maintenance release of Python 3.13     ====================================================

    Python 3.13 is the newest major release of the Python programming language, and it contains many new     features and optimizations compared to Python 3.12. 3.13.1 is the latest maintenance release, containing     almost 400 bugfixes, build improvements and documentation changes since 3.13.0.

    Security content in this release
    --------------------------------

    -   [gh-122792](https://github.com/python/cpython/issues/122792): Changed IPv4-mapped     `ipaddress.IPv6Address` to consistently use the mapped IPv4 address value for deciding properties.
    Properties which have their behavior fixed are `is_multicast`, `is_reserved`, `is_link_local`,     `is_global`, and `is_unspecified`.
    -   CVE-2024-9287: [gh-124651](https://github.com/python/cpython/issues/124651): Properly quote template     strings in `venv` activation scripts.
    -   [gh-125140](https://github.com/python/cpython/issues/125140): Remove the current directory from     sys.path when using PyREPL.
    - CVE-2024-12254: Unbounded memory buffering in `SelectorSocketTransport.writelines()` fixed.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-54aa5fc4b2 advisory.

    Security fix for CVE-2024-12254

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:10980 advisory.

    * python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287)

    * python: Unbounded memory buffering in SelectorSocketTransport.writelines() (CVE-2024-12254)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:10980 advisory.

    * python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287)
      * python: Unbounded memory buffering in SelectorSocketTransport.writelines() (CVE-2024-12254)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:11035 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287)

    * python: Unbounded memory buffering in SelectorSocketTransport.writelines() (CVE-2024-12254)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:4291-1 advisory.

    - CVE-2024-12254: Fixed unbounded memory buffering in SelectorSocketTransport.writelines() (bsc#1234290)

    Other fixes:
    - Updated to version 3.12.8
    - Remove -IVendor/ from python-config (bsc#1231795)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-10980 advisory.

    [3.12.8-1]
    - Update to 3.12.8
    - Security fix for CVE-2024-9287 and CVE-2024-12254     Resolves: RHEL-64880, RHEL-70315

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-10978 advisory.

    [3.12.5-2.2]
    - Security fix for CVE-2024-9287 and CVE-2024-12254     Resolves: RHEL-64885, RHEL-70316

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:10978 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287)

    * python: Unbounded memory buffering in SelectorSocketTransport.writelines() (CVE-2024-12254)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:10980 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287)

    * python: Unbounded memory buffering in SelectorSocketTransport.writelines() (CVE-2024-12254)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-b2cebcbb49 advisory.

    Security fix for CVE-2024-12254

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-340a4bdc5d advisory.

    Security fix for CVE-2024-12254

    ----

    Update to 3.12.8


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
293438	MiracleLinux 9 : python3.12-3.12.5-2.el9_5.2 (AXSA:2024-9442:17)	Nessus	Miracle Linux Local Security Checks	medium
293161	MiracleLinux 8 : python3.12-3.12.8-1.el8_10 (AXSA:2024-9392:15)	Nessus	Miracle Linux Local Security Checks	medium
271256	Oracle Database Server (October 2025 CPU)	Nessus	Databases	high
250339	Linux Distros Unpatched Vulnerability : CVE-2024-12254	Nessus	Misc.	high
240592	SUSE SLED15 / SLES15 Security Update : python313 (SUSE-SU-2025:02074-1)	Nessus	SuSE Local Security Checks	critical
239592	TencentOS Server 4: python3.12 (TSSA-2025:0006)	Nessus	Tencent Local Security Checks	high
238738	TencentOS Server 3: python3.12 (TSSA-2024:1116)	Nessus	Tencent Local Security Checks	medium
232876	RockyLinux 9 : python3.12 (RLSA-2024:10978)	Nessus	Rocky Linux Local Security Checks	high
216390	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python312 (SUSE-SU-2025:0521-1)	Nessus	SuSE Local Security Checks	high
214617	Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2025-808)	Nessus	Amazon Linux Local Security Checks	high
214443	Ubuntu 24.04 LTS / 24.10 : Python vulnerability (USN-7219-1)	Nessus	Ubuntu Local Security Checks	high
213381	Fedora 40 : python3-docs / python3.12 (2024-82a696ca59)	Nessus	Fedora Local Security Checks	high
213323	Fedora 41 : libcomps / libdnf / python3-docs / python3.13 (2024-3c18fe0d93)	Nessus	Fedora Local Security Checks	high
213239	Fedora 40 : python3.13 (2024-be6ea1ce44)	Nessus	Fedora Local Security Checks	high
213235	Fedora 41 : python3.14 (2024-54aa5fc4b2)	Nessus	Fedora Local Security Checks	high
213221	RockyLinux 8 : python3.12 (RLSA-2024:10980)	Nessus	Rocky Linux Local Security Checks	high
213178	AlmaLinux 8 : python3.12 (ALSA-2024:10980)	Nessus	Alma Linux Local Security Checks	high
212760	RHEL 9 : python3.12 (RHSA-2024:11035)	Nessus	Red Hat Local Security Checks	high
212738	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python312 (SUSE-SU-2024:4291-1)	Nessus	SuSE Local Security Checks	high
212715	Oracle Linux 8 : python3.12 (ELSA-2024-10980)	Nessus	Oracle Linux Local Security Checks	high
212714	Oracle Linux 9 : python3.12 (ELSA-2024-10978)	Nessus	Oracle Linux Local Security Checks	high
212679	RHEL 9 : python3.12 (RHSA-2024:10978)	Nessus	Red Hat Local Security Checks	high
212676	RHEL 8 : python3.12 (RHSA-2024:10980)	Nessus	Red Hat Local Security Checks	high
212272	Fedora 40 : python3.14 (2024-b2cebcbb49)	Nessus	Fedora Local Security Checks	high
212208	Fedora 41 : python3.12 (2024-340a4bdc5d)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2024-12254

high

Tenable Plugins

Coming Soon

medium

medium

high

high

critical

high

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high