CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:10950 advisory.

    * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing (CVE-2025-59375)
      * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)
      * cpython: Out-of-memory when loading Plist (CVE-2025-13837)
      * cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)
      * cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)
      * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
      * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
      * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
      * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
      * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression     modules (CVE-2026-6100)
      * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API     (CVE-2026-4786)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-10950 advisory.

    - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644,     CVE-2026-4224     Resolves: RHEL-168130, RHEL-167892

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:10950 advisory.

    * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing (CVE-2025-59375)

    * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

    * cpython: Out-of-memory when loading Plist (CVE-2025-13837)

    * cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)

    * cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)

    * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

    * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

    * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

    * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

    * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression     modules (CVE-2026-6100)

    * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API     (CVE-2026-4786)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6e657e937a advisory.

    Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE 2026-3644,     CVE-2026-4224

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-952616f3d6 advisory.

    Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE 2026-3644,     CVE-2026-4224

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bb0e94c26c advisory.

    Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644,     CVE-2026-4224

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1fd21102d1 advisory.

    Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100

    ----

    New minor version of the alternate Python interpreter


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f04915ebfd advisory.

    Backport fix for CVE-2026-4786.

    ----

    Backport fixes for CVE-2026-6100, CVE-2026-3479, CVE-2026-1502

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-43577dc43b advisory.

    Backport fix for CVE-2026-4786.

    ----

    Backport fixes for CVE-2026-6100, CVE-2026-3479, CVE-2026-1502

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-763e814afa advisory.

    Backport fix for CVE-2026-4786.

    ----

    Backport fixes for CVE-2026-6100, CVE-2026-3479, CVE-2026-1502

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:10950 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing (CVE-2025-59375)

    * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

    * cpython: Out-of-memory when loading Plist (CVE-2025-13837)

    * cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)

    * cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)

    * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

    * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

    * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

    * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

    * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression     modules (CVE-2026-6100)

    * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API     (CVE-2026-4786)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-841a2250e4 advisory.

    Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a5ba8297fd advisory.

    Automatic update for python3.11-3.11.15-4.fc45.

    ##### **Changelog**

    ```
    * Fri Apr 17 2026 Charalampos Stratakis <cstratak@redhat.com> - 3.11.15-4
    - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE 2026-3644,     CVE-2026-4224     Resolves: rhbz#2457941, rhbz#2458221, rhbz#2458013, rhbz#2444704, rhbz#2448188, rhbz#2448204
    * Sat Apr 11 2026 Miro Hronok <mhroncok@redhat.com> - 3.11.15-3
    - Explicitly build with OpenSSL 3

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dd34c4467b advisory.

    Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE 2026-3644,     CVE-2026-4224

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-30fbc5a8b2 advisory.

    Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644,     CVE-2026-4224

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f684007460 advisory.

    Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644,     CVE-2026-4224

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-382df0cfce advisory.

    Automatic update for python3.14-3.14.4-2.fc45.

    ##### **Changelog**

    ```
    * Thu Apr 16 2026 Charalampos Stratakis <cstratak@redhat.com> - 3.14.4-2
    - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100     Resolves: rhbz#2457944, rhbz#2458224, rhbz#2458488, rhbz#2458016

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2dfcf9d705 advisory.

    Automatic update for python3.12-3.12.13-3.fc45.

    ##### **Changelog**

    ```
    * Thu Apr 16 2026 Charalampos Stratakis <cstratak@redhat.com> - 3.12.13-3
    - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644,     CVE-2026-4224     Resolves: rhbz#2444705, rhbz#2448189, rhbz#2448205, rhbz#2457942, rhbz#2458014, rhbz#2458222

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 30bda1c3-369b-11f1-b51c-6dd25bec137b advisory.

    Seth Larson reports:
    HTTP proxy via CONNECT tunneling doesn't sanitize CR/LF (CVE-2026-1502).

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. (CVE-2026-1502)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
310955	AlmaLinux 8 : python3.12 (ALSA-2026:10950)	Nessus	Alma Linux Local Security Checks	critical
310728	Oracle Linux 8 : python3.12 (ELSA-2026-10950)	Nessus	Oracle Linux Local Security Checks	critical
310642	RockyLinux 8 : python3.12 (RLSA-2026:10950)	Nessus	Rocky Linux Local Security Checks	critical
310597	Fedora 44 : python3.11 (2026-6e657e937a)	Nessus	Fedora Local Security Checks	critical
310595	Fedora 43 : python3.11 (2026-952616f3d6)	Nessus	Fedora Local Security Checks	critical
310586	Fedora 44 : python3.12 (2026-bb0e94c26c)	Nessus	Fedora Local Security Checks	critical
310584	Fedora 42 : python3.14 (2026-1fd21102d1)	Nessus	Fedora Local Security Checks	critical
310580	Fedora 44 : mingw-python3 (2026-f04915ebfd)	Nessus	Fedora Local Security Checks	critical
310578	Fedora 43 : mingw-python3 (2026-43577dc43b)	Nessus	Fedora Local Security Checks	critical
310574	Fedora 42 : mingw-python3 (2026-763e814afa)	Nessus	Fedora Local Security Checks	critical
310559	RHEL 8 : python3.12 (RHSA-2026:10950)	Nessus	Red Hat Local Security Checks	critical
310252	Fedora 44 : python3.14 (2026-841a2250e4)	Nessus	Fedora Local Security Checks	critical
307588	Fedora 45 : python3.11 (2026-a5ba8297fd)	Nessus	Fedora Local Security Checks	critical
307517	Fedora 42 : python3.11 (2026-dd34c4467b)	Nessus	Fedora Local Security Checks	critical
307516	Fedora 42 : python3.12 (2026-30fbc5a8b2)	Nessus	Fedora Local Security Checks	critical
307483	Fedora 43 : python3.12 (2026-f684007460)	Nessus	Fedora Local Security Checks	critical
307415	Fedora 45 : python3.14 (2026-382df0cfce)	Nessus	Fedora Local Security Checks	critical
307390	Fedora 45 : python3.12 (2026-2dfcf9d705)	Nessus	Fedora Local Security Checks	critical
306079	FreeBSD : Python -- HTTP proxy CONNECT tunnel does not sanitize CR/LF (30bda1c3-369b-11f1-b51c-6dd25bec137b)	Nessus	FreeBSD Local Security Checks	medium
306058	Linux Distros Unpatched Vulnerability : CVE-2026-1502	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-1502

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

medium

medium