When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8018-1 advisory.

    Denis Ledoux discovered that Python incorrectly parsed email message headers. An attacker could possibly     use this issue to inject arbitrary headers into email messages. This issue only affected python3.6,     python3.7, python3.8, python3.9, python3.10, python3.11, python3.12, python3.13, and python3.14 packages.
    (CVE-2025-11468)

    Jacob Walls, Shai Berger, and Natalia Bidart discovered that Python inefficiently parsed XML input with     quadratic complexity. An attacker could possibly use this issue to cause a denial of service.
    (CVE-2025-12084)

    It was discovered that Python incorrectly parsed malicious plist files. An attacker could possibly use     this issue to cause Python to use excessive resources, leading to a denial of service. This issue only     affected python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12,     python3.13, and python3.14 packages. (CVE-2025-13837)

    Omar Hasan discovered that Python incorrectly parsed URL mediatypes. An attacker could possibly use this     issue to inject arbitrary HTTP headers. (CVE-2025-15282)

    Omar Hasan discovered that Python incorrectly parsed malicious IMAP inputs. An attacker could possibly use     this issue to inject arbitrary IMAP commands. (CVE-2025-15366)

    Omar Hasan discovered that Python incorrectly parsed malicious POP3 inputs. An attacker could possibly use     this issue to inject arbitrary POP3 commands. (CVE-2025-15367)

    Omar Hasan discovered that Python incorrectly parsed malicious HTTP cookie headers. An attacker could     possibly use this issue to inject arbitrary HTTP headers. (CVE-2026-0672)

    Omar Hasan discovered that Python incorrectly parsed malicious HTTP header names and values. An attacker     could possibly use this issue to inject arbitrary HTTP headers. (CVE-2026-0865)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0314-1 advisory.

    - CVE-2025-12084: prevent quadratic behavior in node ID cache clearing (bsc#1254997).
    - CVE-2025-13836: prevent reading an HTTP response from a server, if no read amount is specified, with     using Content-Length per default as the length (bsc#1254400).
    - CVE-2025-13837: protect against OOM when loading malicious content (bsc#1254401).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0299-1 advisory.

    - CVE-2025-12084: prevent quadratic behavior in node ID cache clearing (bsc#1254997).
    - CVE-2025-13836: prevent reading an HTTP response from a server, if no read amount is specified, with     using Content-Length per default as the length (bsc#1254400).
    - CVE-2025-13837: protect against OOM when loading malicious content (bsc#1254401).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - Vulnerability in the Oracle Spatial and Graph (OpenJPEG) component of Oracle Database Server. Supported     versions that are affected are 23.4.0-23.26.0. Easily exploitable vulnerability allows low privileged     attacker having None privilege with logon to the infrastructure where Oracle Spatial and Graph (OpenJPEG)     executes to compromise Oracle Spatial and Graph (OpenJPEG). Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Oracle Spatial and Graph (OpenJPEG).
    (CVE-2025-54874)

  - Vulnerability in the Fleet Patching and Provisioning (Eclipse Jersey) component of Oracle Database Server.
    Supported versions that are affected are 23.4.0-23.26.0. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Fleet Patching and Provisioning     (Eclipse Jersey). Successful attacks of this vulnerability can result in unauthorized creation, deletion     or modification access to critical data or all Fleet Patching and Provisioning (Eclipse Jersey) accessible     data as well as unauthorized access to critical data or complete access to all Fleet Patching and     Provisioning (Eclipse Jersey) accessible data. (CVE-2025-12383)

  - Vulnerability in the SQLcl component of Oracle Database Server. Supported versions that are affected are     23.4.0-23.26.0. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the     infrastructure where SQLcl executes to compromise SQLcl. Successful attacks require human interaction from     a person other than the attacker. Successful attacks of this vulnerability can result in takeover of     SQLcl. (CVE-2026-21939)

  - Vulnerability in the RDBMS (Python) component of Oracle Database Server. Supported versions that are     affected are 21.3-21.20 and 23.4.0-23.26.0. Easily exploitable vulnerability allows high privileged     attacker having Authenticated User privilege with logon to the infrastructure where RDBMS (Python)     executes to compromise RDBMS (Python). Successful attacks of this vulnerability can result in takeover of     RDBMS (Python). (CVE-2025-13836, CVE-2025-13837, CVE-2025-6069, CVE-2025-6075, CVE-2025-8194,     CVE-2025-8291, CVE-2025-8869)

  - Vulnerability in the Oracle Graal Development Kit for Micronaut (Nimbus JOSE+JWT) component of Oracle     Database Server. Supported versions that are affected are 19.3-19.29 and 23.4.0-23.26.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise     Oracle Graal Development Kit for Micronaut (Nimbus JOSE+JWT). Successful attacks of this vulnerability can     result in unauthorized update, insert or delete access to some of Oracle Graal Development Kit for     Micronaut (Nimbus JOSE+JWT) accessible data as well as unauthorized read access to a subset of Oracle     Graal Development Kit for Micronaut (Nimbus JOSE+JWT) accessible data. (CVE-2025-67735)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of CBL-Mariner Releases installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-13837 advisory.

  - When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a     malicious file can cause OOM and DoS issues (CVE-2025-13837)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4445 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4445-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Andrej Shadura     January 20, 2026                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : python3.9     Version        : 3.9.2-1+deb11u4     CVE ID         : CVE-2022-37454 CVE-2025-4516 CVE-2025-6069 CVE-2025-6075                      CVE-2025-8194 CVE-2025-8291 CVE-2025-12084 CVE-2025-13836                      CVE-2025-13837

    Multiple security fixes in cPython 3.9.

    CVE-2022-37454

        The Keccak XKCP SHA-3 implementation had an integer overflow         and a buffer overflow in the sponge function interface. This         allowed attackers to execute arbitrary code or eliminate expected         cryptographic properties.

    CVE-2025-4516

        An issue in bytes.decode(unicode_escape, error=ignore|replace)         could result in a crash.

    CVE-2025-6069

        The html.parser.HTMLParser class had worse-case quadratic complexity         when processing certain crafted malformed inputs potentially leading         to amplified denial-of-service.

    CVE-2025-6075

        If the value passed to os.path.expandvars() is user-controlled         a performance degradation was possible when expanding environment         variables.

    CVE-2025-8194

        The tar implementation would process tar archives with negative         offsets without error, resulting in an infinite loop and deadlock         during the parsing of maliciously crafted tar archives.

    CVE-2025-8291

        The 'zipfile' module would not check the validity of the ZIP64 End         of Central Directory (EOCD) Locator record offset value would not be         used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record         would be assumed to be the previous record in the ZIP archive. This         could be abused to create ZIP archives that are handled differently         by the 'zipfile' module compared to other ZIP implementations.

    CVE-2025-12084

        When building nested elements using xml.dom.minidom methods such         as appendChild() that have a dependency on _clear_id_cache() the         algorithm was quadratic. Availability could be impacted when building         excessively nested documents.

    CVE-2025-13836

        When reading an HTTP response from a server, if no read amount was         specified, the default behavior was to use Content-Length. This         allowed a malicious server to cause the client to read large amounts         of data into memory, potentially causing OOM or other DoS.

    CVE-2025-13837

        When loading a plist file, the plistlib module would read data in         size specified by the file itself, meaning a malicious file could         cause OOM and DoS issues.

    For Debian 11 bullseye, these problems have been fixed in version     3.9.2-1+deb11u4.

    We recommend that you upgrade your python3.9 packages.

    For the detailed security status of python3.9 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python3.9

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0130-1 advisory.

    - CVE-2025-12084: quadratic complexity when building nested elements using `xml.dom.minidom` methods that     depend on       `_clear_id_cache()` can lead to availability issues when building excessively nested documents     (bsc#1254997).
    - CVE-2025-13836: use of `Content-Length` by default when reading an HTTP response with no read amount     specified can       lead to OOM issues and DoS when a client deals with a malicious server (bsc#1254400).
    - CVE-2025-13837: data read by the plistlib module according to the size specified by the file itself can     lead to OOM       issues and DoS (bsc#1254401).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1356 advisory.

    When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency     on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively     nested documents. (CVE-2025-12084)

    When reading an HTTP response from a server, if no read amount is specified, the default behavior will be     to use Content-Length. This allows a malicious server to cause the client to read large amounts of data     into memory, potentially causing OOM or other DoS. (CVE-2025-13836)

    When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a     malicious file can cause OOM and DoS issues (CVE-2025-13837)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1344 advisory.

    When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency     on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively     nested documents. (CVE-2025-12084)

    When reading an HTTP response from a server, if no read amount is specified, the default behavior will be     to use Content-Length. This allows a malicious server to cause the client to read large amounts of data     into memory, potentially causing OOM or other DoS. (CVE-2025-13836)

    When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a     malicious file can cause OOM and DoS issues (CVE-2025-13837)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1325 advisory.

    When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency     on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively     nested documents. (CVE-2025-12084)

    When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a     malicious file can cause OOM and DoS issues (CVE-2025-13837)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1343 advisory.

    When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency     on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively     nested documents. (CVE-2025-12084)

    When reading an HTTP response from a server, if no read amount is specified, the default behavior will be     to use Content-Length. This allows a malicious server to cause the client to read large amounts of data     into memory, potentially causing OOM or other DoS. (CVE-2025-13836)

    When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a     malicious file can cause OOM and DoS issues (CVE-2025-13837)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0024-1 advisory.

    Update to version 3.13.11.

    Security issues fixed:

    - CVE-2025-12084: quadratic complexity when building nested elements using `xml.dom.minidom` methods that     depend on       `_clear_id_cache()` can lead to availability issues when building excessively nested documents     (bsc#1254997).
    - CVE-2025-13836: use of `Content-Length` by default when reading an HTTP response with no read amount     specified can       lead to OOM issues and DoS when a client deals with a malicious server (bsc#1254400).
    - CVE-2025-13837: data read by the plistlib module according to the size specified by the file itself can     lead to OOM       issues and DoS (bsc#1254401).

    Other updates and bugfixes:

    - Version 3.13.11:
      * Library
        - gh-140797: Revert changes to the undocumented re.Scanner           class. Capturing groups are still allowed for backward           compatibility, although using them can lead to incorrect           result. They will be forbidden in future Python versions.
        - gh-142206: The resource tracker in the multiprocessing           module now uses the original communication protocol, as in           Python 3.14.0 and below, by default. This avoids issues           with upgrading Python while it is running. (Note that such           in-place upgrades are not tested.) The tracker remains           compatible with subprocesses that use new protocol (that           is, subprocesses using Python 3.13.10, 3.14.1 and 3.15).
      * Core and Builtins
        - gh-142218: Fix crash when inserting into a split table           dictionary with a non str key that matches an existing key.

    - Version to 3.13.10:
      * Security
        - gh-137836: Add support of the plaintext element, RAWTEXT           elements xmp, iframe, noembed and noframes, and           optionally RAWTEXT element noscript in           html.parser.HTMLParser.
        - gh-136063: email.message: ensure linear complexity for           legacy HTTP parameters parsing. Patch by B?n?dikt Tran.
      * Library
        - gh-74389: When the stdin being used by a subprocess.Popen           instance is closed, this is now ignored in           subprocess.Popen.communicate() instead of leaving the class           in an inconsistent state.
        - gh-87512: Fix subprocess.Popen.communicate() timeout           handling on Windows when writing large input. Previously,           the timeout was ignored during stdin writing, causing the           method to block indefinitely if the child process did not           consume input quickly. The stdin write is now performed in           a background thread, allowing the timeout to be properly           enforced.
        - gh-141473: When subprocess.Popen.communicate() was called           with input and a timeout and is called for a second time           after a TimeoutExpired exception before the process has           died, it should no longer hang.
        - gh-59000: Fix pdb breakpoint resolution for class methods           when the module defining the class is not imported.
        - gh-141570: Support file-like object raising OSError from           fileno() in color detection (_colorize.can_colorize()).
          This can occur when sys.stdout is redirected.
        - gh-141659: Fix bad file descriptor errors from
          _posixsubprocess on AIX.
        - gh-141497: ipaddress: ensure that the methods           IPv4Network.hosts() and IPv6Network.hosts() always return           an iterator.
        - gh-140938: The statistics.stdev() and statistics.pstdev()           functions now raise a ValueError when the input contains an           infinity or a NaN.
        - gh-124111: Updated Tcl threading configuration in _tkinter           to assume that threads are always available in Tcl 9 and           later.
        - gh-137109: The os.fork and related forking APIs will no           longer warn in the common case where Linux or macOS           platform APIs return the number of threads in a process and           find the answer to be 1 even when a os.register_at_fork()           after_in_parent= callback (re)starts a thread.
        - gh-141314: Fix assertion failure in io.TextIOWrapper.tell()           when reading files with standalone carriage return (\r)           line endings.
        - gh-141311: Fix assertion failure in io.BytesIO.readinto()           and undefined behavior arising when read position is above           capcity in io.BytesIO.
        - gh-141141: Fix a thread safety issue with           base64.b85decode(). Contributed by Benel Tayar.
        - gh-140911: collections: Ensure that the methods           UserString.rindex() and UserString.index() accept           collections.UserString instances as the sub argument.
        - gh-140797: The undocumented re.Scanner class now forbids           regular expressions containing capturing groups in its           lexicon patterns. Patterns using capturing groups could           previously lead to crashes with segmentation fault. Use           non-capturing groups (?:) instead.
        - gh-140815: faulthandler now detects if a frame or a code           object is invalid or freed. Patch by Victor Stinner.
        - gh-100218: Correctly set errno when socket.if_nametoindex()           or socket.if_indextoname() raise an OSError. Patch by           B?n?dikt Tran.
        - gh-140875: Fix handling of unclosed character references           (named and numerical) followed by the end of file in           html.parser.HTMLParser with convert_charrefs=False.
        - gh-140734: multiprocessing: fix off-by-one error when           checking the length of a temporary socket file path. Patch           by B?n?dikt Tran.
        - gh-140874: Bump the version of pip bundled in ensurepip to           version 25.3
        - gh-140691: In urllib.request, when opening a FTP URL fails           because a data connection cannot be made, the control           connections socket is now closed to avoid           a ResourceWarning.
        - gh-103847: Fix hang when cancelling process created by           asyncio.create_subprocess_exec() or           asyncio.create_subprocess_shell(). Patch by Kumar Aditya.
        - gh-140590: Fix arguments checking for the           functools.partial.__setstate__() that may lead to internal           state corruption and crash. Patch by Sergey Miryanov.
        - gh-140634: Fix a reference counting bug in           os.sched_param.__reduce__().
        - gh-140633: Ignore AttributeError when setting a modules
          __file__ attribute when loading an extension module           packaged as Apple Framework.
        - gh-140593: xml.parsers.expat: Fix a memory leak that could           affect users with ElementDeclHandler() set to a custom           element declaration handler. Patch by Sebastian Pipping.
        - gh-140607: Inside io.RawIOBase.read(), validate that the           count of bytes returned by io.RawIOBase.readinto() is valid           (inside the provided buffer).
        - gh-138162: Fix logging.LoggerAdapter with merge_extra=True           and without the extra argument.
        - gh-140474: Fix memory leak in array.array when creating           arrays from an empty str and the u type code.
        - gh-140272: Fix memory leak in the clear() method of the           dbm.gnu database.
        - gh-140041: Fix import of ctypes on Android and Cygwin when           ABI flags are present.
        - gh-139905: Add suggestion to error message for           typing.Generic subclasses when cls.__parameters__ is           missing due to a parent class failing to call           super().__init_subclass__() in its __init_subclass__.
        - gh-139845: Fix to not print KeyboardInterrupt twice in           default asyncio REPL.
        - gh-139783: Fix inspect.getsourcelines() for the case when           a decorator is followed by a comment or an empty line.
        - gh-70765: http.server: fix default handling of HTTP/0.9           requests in BaseHTTPRequestHandler. Previously,           BaseHTTPRequestHandler.parse_request() incorrectly waited           for headers in the request although those are not supported           in HTTP/0.9. Patch by B?n?dikt Tran.
        - gh-139391: Fix an issue when, on non-Windows platforms, it           was not possible to gracefully exit a python -m asyncio           process suspended by Ctrl+Z and later resumed by fg other           than with kill.
        - gh-101828: Fix 'shift_jisx0213', 'shift_jis_2004',           'euc_jisx0213' and 'euc_jis_2004' codecs truncating null           chars as they were treated as part of multi-character           sequences.
        - gh-139246: fix: paste zero-width in default repl width is           wrong.
        - gh-90949: Add SetAllocTrackerActivationThreshold() and           SetAllocTrackerMaximumAmplification() to xmlparser objects           to prevent use of disproportional amounts of dynamic memory           from within an Expat parser. Patch by B?n?dikt Tran.
        - gh-139065: Fix trailing space before a wrapped long word if           the line length is exactly width in textwrap.
        - gh-138993: Dedent credits text.
        - gh-138859: Fix generic type parameterization raising           a TypeError when omitting a ParamSpec that has a default           which is not a list of types.
        - gh-138775: Use of python -m with base64 has been fixed to           detect input from a terminal so that it properly notices           EOF.
        - gh-98896: Fix a failure in multiprocessing resource_tracker           when SharedMemory names contain colons. Patch by Rani           Pinchuk.
        - gh-75989: tarfile.TarFile.extractall() and           tarfile.TarFile.extract() now overwrite symlinks when           extracting hardlinks. (Contributed by Alexander Enrique           Urieles Nieto in gh-75989.)
        - gh-83424: Allows creating a ctypes.CDLL without name when           passing a handle as an argument.
        - gh-136234: Fix asyncio.WriteTransport.writelines() to be           robust to connection failure, by using the same behavior as           write().
        - gh-136057: Fixed the bug in pdb and bdb where next and step           cant go over the line if a loop exists in the line.
        - gh-135307: email: Fix exception in set_content() when           encoding text and max_line_length is set to 0 or None           (unlimited).
        - gh-134453: Fixed subprocess.Popen.communicate() input=           handling of memoryview instances that were non-byte shaped           on POSIX platforms. Those are now properly cast to a byte           shaped view instead of truncating the input. Windows           platforms did not have this bug.
        - gh-102431: Clarify constraints for logical arguments in           methods of decimal.Context.
      * IDLE
        - gh-96491: Deduplicate version number in IDLE shell title           bar after saving to a file.
      * Core and Builtins
        - gh-142048: Fix quadratically increasing garbage collection           delays in free-threaded build.
        - gh-141930: When importing a module, use Pythons regular           file object to ensure that writes to .pyc files are           complete or an appropriate error is raised.
        - gh-120158: Fix inconsistent state when enabling or           disabling monitoring events too many times.
        - gh-141579: Fix sys.activate_stack_trampoline() to properly           support the perf_jit backend. Patch by Pablo Galindo.
        - gh-141312: Fix the assertion failure in the __setstate__           method of the range iterator when a non-integer argument is           passed. Patch by Sergey Miryanov.
        - gh-140939: Fix memory leak when bytearray or bytes is           formated with the           %*b format with a large width that results in           %a MemoryError.
        - gh-140530: Fix a reference leak when raise exc from cause           fails. Patch by B?n?dikt Tran.
        - gh-140576: Fixed crash in tokenize.generate_tokens() in           case of specific incorrect input. Patch by Mikhail Efimov.
        - gh-140551: Fixed crash in dict if dict.clear() is called at           the lookup stage. Patch by Mikhail Efimov and Inada Naoki.
        - gh-140471: Fix potential buffer overflow in ast.AST node           initialization when encountering malformed _fields           containing non-str.
        - gh-140406: Fix memory leak when an objects __hash__()           method returns an object that isnt an int.
        - gh-140306: Fix memory leaks in cross-interpreter channel           operations and shared namespace handling.
        - gh-140301: Fix memory leak of PyConfig in subinterpreters.
        - gh-140000: Fix potential memory leak when a reference cycle           exists between an instance of typing.TypeAliasType,           typing.TypeVar, typing.ParamSpec, or typing.TypeVarTuple           and its __name__ attribute. Patch by Mikhail Efimov.
        - gh-139748: Fix reference leaks in error branches of           functions accepting path strings or bytes such as compile()           and os.system(). Patch by B?n?dikt Tran.
        - gh-139516: Fix lambda colon erroneously start format spec           in f-string in tokenizer.
        - gh-139640: Fix swallowing some syntax warnings in different           modules if they accidentally have the same message and are           emitted from the same line. Fix duplicated warnings in the           finally block.
        - gh-137400: Fix a crash in the free threading build when           disabling profiling or tracing across all threads with           PyEval_SetProfileAllThreads() or           PyEval_SetTraceAllThreads() or their Python equivalents           threading.settrace_all_threads() and           threading.setprofile_all_threads().
        - gh-133400: Fixed Ctrl+D (^D) behavior in _pyrepl module to           match old pre-3.13 REPL behavior.
      * C API
        - gh-140042: Removed the sqlite3_shutdown call that could           cause closing connections for sqlite when used with           multiple sub interpreters.
        - gh-140487: Fix Py_RETURN_NOTIMPLEMENTED in limited C API           3.11 and older: dont treat Py_NotImplemented as immortal.
          Patch by Victor Stinner.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0027-1 advisory.

    - CVE-2025-12084: cpython: Fixed quadratic algorithm in xml.dom.minidom leading to denial of service     (bsc#1254997)
    - CVE-2025-13836: Fixed default Content-Lenght read amount from HTTP response (bsc#1254400)
    - CVE-2025-13837: Fixed plistlib module denial of service (bsc#1254401)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0025-1 advisory.

    - CVE-2025-12084: quadratic complexity when building nested elements using `xml.dom.minidom` methods that     depend on       `_clear_id_cache()` can lead to availability issues when building excessively nested documents     (bsc#1254997).
    - CVE-2025-13836: use of `Content-Length` by default when reading an HTTP response with no read amount     specified can       lead to OOM issues and DoS when a client deals with a malicious server (bsc#1254400).
    - CVE-2025-13837: data read by the plistlib module according to the size specified by the file itself can     lead to OOM       issues and DoS (bsc#1254401).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of python3 installed on the remote host is prior to 3.7.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3103 advisory.

    When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency     on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively     nested documents. (CVE-2025-12084)

    When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a     malicious file can cause OOM and DoS issues (CVE-2025-13837)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4539-1 advisory.

    - CVE-2025-12084: quadratic complexity when building nested elements using `xml.dom.minidom` methods that     depend on       `_clear_id_cache()` can lead to availability issues when building excessively nested documents     (bsc#1254997).
    - CVE-2025-13836: use of `Content-Length` by default when reading an HTTP response with no read amount     specified can       lead to OOM issues and DoS when a client deals with a malicious server (bsc#1254400).
    - CVE-2025-13837: data read by the plistlib module according to the size specified by the file itself can     lead to OOM       issues and DoS (bsc#1254401).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4538-1 advisory.

    - CVE-2025-12084: cpython: Fixed quadratic algorithm in xml.dom.minidom leading to denial of service     (bsc#1254997)
    - CVE-2025-13836: Fixed default Content-Lenght read amount from HTTP response (bsc#1254400)
    - CVE-2025-13837: Fixed plistlib module denial of service (bsc#1254401)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993333 advisory.

    When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a     malicious file can cause OOM and DoS issues

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4522-1 advisory.

    - CVE-2025-12084: quadratic complexity when building nested elements using `xml.dom.minidom` methods that     depend on       `_clear_id_cache()` can lead to availability issues when building excessively nested documents     (bsc#1254997).
    - CVE-2025-13836: use of `Content-Length` by default when reading an HTTP response with no read amount     specified can       lead to OOM issues and DoS when a client deals with a malicious server (bsc#1254400).
    - CVE-2025-13837: data read by the plistlib module according to the size specified by the file itself can     lead to OOM       issues and DoS (bsc#1254401).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0968 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-13837:
    When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a     malicious file can cause OOM and DoS issues

    CVE-2025-13836:
    When reading an HTTP response from a server, if no read amount is specified, the default behavior will be     to use Content-Length. This allows a malicious server to cause the client to read large amounts of data     into memory, potentially causing OOM or other DoS.

    CVE-2025-12084:
    When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency     on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively     nested documents.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a     malicious file can cause OOM and DoS issues (CVE-2025-13837)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
298266	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : Python vulnerabilities (USN-8018-1)	Nessus	Ubuntu Local Security Checks	medium
297184	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python311 (SUSE-SU-2026:0314-1)	Nessus	SuSE Local Security Checks	medium
297010	SUSE SLES15 Security Update : python311 (SUSE-SU-2026:0299-1)	Nessus	SuSE Local Security Checks	medium
296562	openSUSE 16 Security Update : python313 (openSUSE-SU-2026:20081-1)	Nessus	SuSE Local Security Checks	medium
296378	Oracle Database Server (January 2026 CPU)	Nessus	Databases	critical
295002	Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2025-13837)	Nessus	Azure Linux Local Security Checks	low
294786	Debian dla-4445 : idle-python3.9 - security update	Nessus	Debian Local Security Checks	medium
288033	openSUSE 15 Security Update : python310 (SUSE-SU-2026:0130-1)	Nessus	SuSE Local Security Checks	medium
282408	Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2025-1356)	Nessus	Amazon Linux Local Security Checks	medium
282406	Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2025-1344)	Nessus	Amazon Linux Local Security Checks	medium
282389	Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2025-1325)	Nessus	Amazon Linux Local Security Checks	medium
282372	Amazon Linux 2023 : python3.13, python3.13-devel, python3.13-freethreading (ALAS2023-2025-1343)	Nessus	Amazon Linux Local Security Checks	medium
281836	SUSE SLED15 / SLES15 Security Update : python313 (SUSE-SU-2026:0024-1)	Nessus	SuSE Local Security Checks	medium
281831	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python3 (SUSE-SU-2026:0027-1)	Nessus	SuSE Local Security Checks	medium
281830	openSUSE 15 Security Update : python312 (SUSE-SU-2026:0025-1)	Nessus	SuSE Local Security Checks	medium
281788	Amazon Linux 2 : python3, --advisory ALAS2-2025-3103 (ALAS-2025-3103)	Nessus	Amazon Linux Local Security Checks	medium
281592	SUSE SLES12 Security Update : python36 (SUSE-SU-2025:4539-1)	Nessus	SuSE Local Security Checks	medium
281591	SUSE SLES12 Security Update : python3 (SUSE-SU-2025:4538-1)	Nessus	SuSE Local Security Checks	medium
281055	Unity Linux 20.1070e Security Update: python3 (UTSA-2025-993333)	Nessus	Unity Linux Local Security Checks	low
280088	openSUSE 15 Security Update : python39 (SUSE-SU-2025:4522-1)	Nessus	SuSE Local Security Checks	medium
279652	TencentOS Server 4: python3.11 (TSSA-2025:0968)	Nessus	Tencent Local Security Checks	medium
277038	Linux Distros Unpatched Vulnerability : CVE-2025-13837	Nessus	Misc.	low

Detections

Analytics

CVE-2025-13837

low

Tenable Plugins

medium

medium

medium

medium

critical

low

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

low

medium

medium

low