User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8018-1 advisory.

    Denis Ledoux discovered that Python incorrectly parsed email message headers. An attacker could possibly     use this issue to inject arbitrary headers into email messages. This issue only affected python3.6,     python3.7, python3.8, python3.9, python3.10, python3.11, python3.12, python3.13, and python3.14 packages.
    (CVE-2025-11468)

    Jacob Walls, Shai Berger, and Natalia Bidart discovered that Python inefficiently parsed XML input with     quadratic complexity. An attacker could possibly use this issue to cause a denial of service.
    (CVE-2025-12084)

    It was discovered that Python incorrectly parsed malicious plist files. An attacker could possibly use     this issue to cause Python to use excessive resources, leading to a denial of service. This issue only     affected python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12,     python3.13, and python3.14 packages. (CVE-2025-13837)

    Omar Hasan discovered that Python incorrectly parsed URL mediatypes. An attacker could possibly use this     issue to inject arbitrary HTTP headers. (CVE-2025-15282)

    Omar Hasan discovered that Python incorrectly parsed malicious IMAP inputs. An attacker could possibly use     this issue to inject arbitrary IMAP commands. (CVE-2025-15366)

    Omar Hasan discovered that Python incorrectly parsed malicious POP3 inputs. An attacker could possibly use     this issue to inject arbitrary POP3 commands. (CVE-2025-15367)

    Omar Hasan discovered that Python incorrectly parsed malicious HTTP cookie headers. An attacker could     possibly use this issue to inject arbitrary HTTP headers. (CVE-2026-0672)

    Omar Hasan discovered that Python incorrectly parsed malicious HTTP header names and values. An attacker     could possibly use this issue to inject arbitrary HTTP headers. (CVE-2026-0865)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in     the data URL mediatype. (CVE-2025-15282)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4455 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4455-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Andrej Shadura     January 25, 2026                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : python3.9     Version        : 3.9.2-1+deb11u5     CVE ID         : CVE-2025-11468 CVE-2025-12084 CVE-2025-15282 CVE-2025-15366                      CVE-2025-15367 CVE-2026-0672 CVE-2026-0865 CVE-2026-1299

    This upload fixes a regression introduced in 3.9.2-1+deb11u4 (DLA 4445-1),     and also fixes multiple security issues in cPython 3.9.

    CVE-2025-12084

        When building nested elements using xml.dom.minidom methods such         as appendChild() that have a dependency on _clear_id_cache() the         algorithm was quadratic. Availability could be impacted when building         excessively nested documents.

        The fix for this CVE in the previous upload resulted in a regression         in software relying on ownerDocument attribute being always present         in Element instances. This regression has now been fixed.

    CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2025-15366, CVE-2025-15367

        These are all similar vulnerabilities in the following modules:
        http.cookies, wsgiref.headers, imaplib, poplib, urllib. In each of         these control characters were handled incorrectly, allowing injection         of additional cookiers, headers or commands. Control characters are         now rejected in these contexts.

    CVE-2025-11468

        An issue similar to the above. Comments consisting of a very long         sequence of non-foldable characters could trigger a forced line wrap         that omitted the required leading space on the continuation line,         causing the remainder of the comment to be interpreted as a new         header field.

    CVE-2026-1299

        Another header injection issue: email module allowed header injection in the         BytesGenerator class. BytesGenerator will now refuse to serialize headers         that are unsafely folded or delimited.

    For Debian 11 bullseye, these problems have been fixed in version     3.9.2-1+deb11u5.

    We recommend that you upgrade your python3.9 packages.

    For the detailed security status of python3.9 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python3.9

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
298266	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : Python vulnerabilities (USN-8018-1)	Nessus	Ubuntu Local Security Checks	medium
297712	Linux Distros Unpatched Vulnerability : CVE-2025-15282	Nessus	Misc.	medium
296553	Debian dla-4455 : idle-python3.9 - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2025-15282

medium

Tenable Plugins

medium

medium

medium