User-controlled header names and values containing newlines can allow injecting HTTP headers.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0035 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2025-12084:
    When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency     on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively     nested documents.

    CVE-2025-15366:
    The imaplib module, when passed a user-controlled command, can have additional commands injected using     newlines. Mitigation rejects commands containing control characters.

    CVE-2025-15367:
    The poplib module, when passed a user-controlled command, can have     additional commands injected using newlines. Mitigation rejects commands     containing control characters.

    CVE-2026-0865:
    User-controlled header names and values containing newlines can allow injecting HTTP headers.

    CVE-2026-1299:
    The     email module, specifically the BytesGenerator class, didnt properly quote newlines for email headers     when     serializing an email message allowing for header injection when an email     is serialized. This is only applicable if using LiteralHeader writing headers that don't respect email     folding rules, the new behavior will reject the incorrectly folded headers in BytesGenerator.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d68ca022b1 advisory.

    - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367, CVE-2026-1299

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f5514402fd advisory.

    - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367, CVE-2026-1299

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-153:02 advisory.

    * cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865)
      * cpython: IMAP command injection in user-controlled commands (CVE-2025-15366)
      * cpython: POP3 command injection in user-controlled commands (CVE-2025-15367)
      * cpython: email header injection due to unquoted newlines (CVE-2026-1299)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8018-1 advisory.

    Denis Ledoux discovered that Python incorrectly parsed email message headers. An attacker could possibly     use this issue to inject arbitrary headers into email messages. This issue only affected python3.6,     python3.7, python3.8, python3.9, python3.10, python3.11, python3.12, python3.13, and python3.14 packages.
    (CVE-2025-11468)

    Jacob Walls, Shai Berger, and Natalia Bidart discovered that Python inefficiently parsed XML input with     quadratic complexity. An attacker could possibly use this issue to cause a denial of service.
    (CVE-2025-12084)

    It was discovered that Python incorrectly parsed malicious plist files. An attacker could possibly use     this issue to cause Python to use excessive resources, leading to a denial of service. This issue only     affected python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12,     python3.13, and python3.14 packages. (CVE-2025-13837)

    Omar Hasan discovered that Python incorrectly parsed URL mediatypes. An attacker could possibly use this     issue to inject arbitrary HTTP headers. (CVE-2025-15282)

    Omar Hasan discovered that Python incorrectly parsed malicious IMAP inputs. An attacker could possibly use     this issue to inject arbitrary IMAP commands. (CVE-2025-15366)

    Omar Hasan discovered that Python incorrectly parsed malicious POP3 inputs. An attacker could possibly use     this issue to inject arbitrary POP3 commands. (CVE-2025-15367)

    Omar Hasan discovered that Python incorrectly parsed malicious HTTP cookie headers. An attacker could     possibly use this issue to inject arbitrary HTTP headers. (CVE-2026-0672)

    Omar Hasan discovered that Python incorrectly parsed malicious HTTP header names and values. An attacker     could possibly use this issue to inject arbitrary HTTP headers. (CVE-2026-0865)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-2128 advisory.

    [3.6.8-73.0.1]
    - Add Oracle Linux distribution in platform.py [Orabug: 20812544]

    [3.6.8.openela.0]
    - Add openela to supported dists

    [3.6.8-73]
    - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367, CVE-2026-1299     Resolves: RHEL-143063, RHEL-143120, RHEL-144860

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:2128 advisory.

    * cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865)
      * cpython: IMAP command injection in user-controlled commands (CVE-2025-15366)
      * cpython: POP3 command injection in user-controlled commands (CVE-2025-15367)
      * cpython: email header injection due to unquoted newlines (CVE-2026-1299)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:2128 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865)

    * cpython: IMAP command injection in user-controlled commands (CVE-2025-15366)

    * cpython: POP3 command injection in user-controlled commands (CVE-2025-15367)

    * cpython: email header injection due to unquoted newlines (CVE-2026-1299)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the bfe9adc8-0224-11f1-8790-c5fb948922ad advisory.

    The Python project announces a new release with several security fixes:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - User-controlled header names and values containing newlines can allow injecting HTTP headers.
    (CVE-2026-0865)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4455 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4455-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Andrej Shadura     January 25, 2026                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : python3.9     Version        : 3.9.2-1+deb11u5     CVE ID         : CVE-2025-11468 CVE-2025-12084 CVE-2025-15282 CVE-2025-15366                      CVE-2025-15367 CVE-2026-0672 CVE-2026-0865 CVE-2026-1299

    This upload fixes a regression introduced in 3.9.2-1+deb11u4 (DLA 4445-1),     and also fixes multiple security issues in cPython 3.9.

    CVE-2025-12084

        When building nested elements using xml.dom.minidom methods such         as appendChild() that have a dependency on _clear_id_cache() the         algorithm was quadratic. Availability could be impacted when building         excessively nested documents.

        The fix for this CVE in the previous upload resulted in a regression         in software relying on ownerDocument attribute being always present         in Element instances. This regression has now been fixed.

    CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2025-15366, CVE-2025-15367

        These are all similar vulnerabilities in the following modules:
        http.cookies, wsgiref.headers, imaplib, poplib, urllib. In each of         these control characters were handled incorrectly, allowing injection         of additional cookiers, headers or commands. Control characters are         now rejected in these contexts.

    CVE-2025-11468

        An issue similar to the above. Comments consisting of a very long         sequence of non-foldable characters could trigger a forced line wrap         that omitted the required leading space on the continuation line,         causing the remainder of the comment to be interpreted as a new         header field.

    CVE-2026-1299

        Another header injection issue: email module allowed header injection in the         BytesGenerator class. BytesGenerator will now refuse to serialize headers         that are unsafely folded or delimited.

    For Debian 11 bullseye, these problems have been fixed in version     3.9.2-1+deb11u5.

    We recommend that you upgrade your python3.9 packages.

    For the detailed security status of python3.9 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python3.9

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
298939	Alibaba Cloud Linux 3 : 0035: python3 (ALINUX3-SA-2026:0035)	Nessus	Alibaba Cloud Linux Local Security Checks	medium
298448	Fedora 43 : python3.6 (2026-d68ca022b1)	Nessus	Fedora Local Security Checks	medium
298447	Fedora 42 : python3.6 (2026-f5514402fd)	Nessus	Fedora Local Security Checks	medium
298356	MiracleLinux 8 : python3-3.6.8-73.el8_10.ML.1 (AXSA:2026-153:02)	Nessus	Miracle Linux Local Security Checks	medium
298266	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : Python vulnerabilities (USN-8018-1)	Nessus	Ubuntu Local Security Checks	medium
298222	Oracle Linux 8 : python3 (ELSA-2026-2128)	Nessus	Oracle Linux Local Security Checks	medium
298194	AlmaLinux 8 : python3 (ALSA-2026:2128)	Nessus	Alma Linux Local Security Checks	medium
298055	RHEL 8 : python3 (RHSA-2026:2128)	Nessus	Red Hat Local Security Checks	medium
298034	FreeBSD : python -- several security vulnerabilities (bfe9adc8-0224-11f1-8790-c5fb948922ad)	Nessus	FreeBSD Local Security Checks	medium
297681	Linux Distros Unpatched Vulnerability : CVE-2026-0865	Nessus	Misc.	medium
296553	Debian dla-4455 : idle-python3.9 - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2026-0865

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium