Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4744-1 advisory.

    Security issues fixed:

    - CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of     service via high       CPU usage (bsc#1273148).
    - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
    - CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).
    - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme     (bsc#1276223).
    - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0     (bsc#1276226).
    - CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during     dialect       sniffing and consume significant CPU (bsc#1274683).
    - CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination     (bsc#1276227).
    - CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link,     allowing file       modification and content disclosure (bsc#1280459).

    Changes for python3:

    - Update bundled setuptools wheels to setuptools-40.6.2 (bsc#1276903).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4743-1 advisory.

    Security issues fixed:

    - CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting     maliciously       crafted wheel archives (bsc#1274743).
    - CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429).
    - CVE-2026-3446: Base64 decoding stops at first padded quad by default (bsc#1261970).
    - CVE-2026-3479: python: improper resource argument validation can allow path traversal (bsc#1259989).
    - CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).
    - CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of     service via high       CPU usage (bsc#1273148).
    - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
    - CVE-2026-13346: Arbitrary file installation via malicious package indexes (bsc#1273090 bsc#1273091     bsc#1273094).
    - CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).
    - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme     (bsc#1276223).
    - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0     (bsc#1276226).
    - CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during     dialect       sniffing and consume significant CPU (bsc#1274683).
    - CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination     (bsc#1276227).
    - CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link,     allowing file       modification and content disclosure (bsc#1280459).

    Non security issue fixed:

    - Update bundled setuptools wheels to      setuptools-44.1.1-py2.py3-none-any.whl (bsc#1277271)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4633-1 advisory.

    - CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of     service via high       CPU usage (bsc#1273148).
    - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
    - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme     (bsc#1276223).
    - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0     (bsc#1276226).
    - CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during     dialect       sniffing and consume significant CPU (bsc#1274683).
    - CVE-2026-19672: The tarfile module's tar and data extraction filters created directories outside the     destination for       members whose name leaves the destination and retu (bsc#1276227).

    Changes for python:

    - Update bundled setuptools wheels to setuptools-40.6.2-py2.py3-none-any.whl (bsc#1276903)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791921187 advisory.

  - Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing     and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
    (CVE-2026-18503)

  - `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using     XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag     siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such     as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match. (CVE-2026-6879)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4827 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4827-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Andrej Shadura     October 08, 2026                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : python3.11     Version        : 3.11.2-6+deb12u9     CVE ID         : CVE-2025-69534 CVE-2026-1502 CVE-2026-3276 CVE-2026-6019                      CVE-2026-8328 CVE-2026-9669 CVE-2026-15308 CVE-2026-15310                      CVE-2026-15806 CVE-2026-17084 CVE-2026-18503 CVE-2026-19445                      CVE-2026-19553     Debian Bug     : 1131896

    Multiple vulnerabilities in Python 3.11.

    CVE-2025-69534

        Malformed markup declarations could make html.parser.HTMLParser         raise an unhandled AssertionError. Applications parsing untrusted         HTML, such as Python-Markdown rendering untrusted input, could         crash, resulting in denial of service.

    CVE-2026-1502

        http.client did not reject CR/LF bytes in the proxy tunnel host or         in tunnel request headers, which could allow HTTP header injection.

    CVE-2026-3276

        unicodedata.normalize() could take excessive CPU time when         processing specially crafted Unicode input containing long runs of         combining characters with alternating canonical combining class         values. This affected all normalization forms.

    CVE-2026-6019

        http.cookies.Morsel.js_output() returned an inline <script> snippet         in which the cookie value was only escaped for the JavaScript string         context, without neutralising the </script> sequence, so         attacker-controlled cookie values could inject markup into the page.

    CVE-2026-8328

        ftplib.ftpcp() was not updated when CVE-2021-4189 was fixed and         still passed the address returned by the source server for PASV to         the target server. A malicious source FTP server could use this to         direct the target server's data connection to an arbitrary host and         port.

    CVE-2026-9669

        bz2.BZ2Decompressor objects could be reused after a decompression         error. If an application caught the resulting OSError and retried         with the same decompressor, crafted input could cause out-of-bounds         writes to a stack buffer, crashing the process.

    CVE-2026-15308

        Feeding html.parser.HTMLParser incrementally with long unterminated         constructs, such as tags or comments, took quadratic time, allowing         denial of service through CPU exhaustion.

    CVE-2026-15310

        When decompressing crafted zip files using bzip2 or LZMA         compression, zipfile could use an attacker-controlled size to         pre-allocate memory, possibly resulting in memory exhaustion.

    CVE-2026-15806

        urllib.request.HTTPPasswordMgr and its subclasses did not take the         URL scheme into account when matching stored credentials.
        Credentials added for an https:// URL were also sent to the same         host over http://, so an attacker able to redirect or downgrade a         client to plain HTTP could capture them in cleartext.

    CVE-2026-17084

        The stringprep module used current Unicode codepoint attributes         instead of those of Unicode 3.2.0, as required by RFC 3454, when         checking tables B.2 and B.3. This could cause mismatches when         processing domain names with the IDNA 2003 (idna) codec.

    CVE-2026-18503

        Attacker-controlled CSV samples could trigger super-linear regular         expression matching in csv.Sniffer.sniff(), consuming significant         CPU time.

    CVE-2026-19445

        A remote, unauthenticated TLS client could make a server crash or         call through a freed pointer if the server's sni_callback assigned a         different context to SSLSocket.context and nothing else kept the         original ssl.SSLContext alive.


    CVE-2026-19553

        ssl.SSLContext.wrap_bio() did not require the server_hostname         argument when check_hostname was enabled, so hostname verification         could be silently skipped; asyncio's create_connection() and         loop.start_tls() were affected as well. For compatibility, Python         3.11 now emits a DeprecationWarning in this case instead of raising         ValueError, so applications still need to pass a valid         server_hostname.

    For Debian 12 bookworm, these problems have been fixed in version     3.11.2-6+deb12u9.

    In addition, this update includes the following related upstream fixes:

      * csv.Sniffer.sniff() could take exponential time on samples with many         quote characters while detecting doubled quotes (gh-109638).

      * Regular expressions with possessive quantifiers could give wrong         matches when the repeated sub-pattern contained backtracking         (gh-100061, gh-106052).

      * html.parser.HTMLParser did not parse start and end tags according         to the HTML5 standard, and could lose data after an unclosed script         or style tag (gh-135661, gh-86155). As a result of the fix, some         malformed markup is parsed differently; for example, </ script>         no longer ends a script element.

    We recommend that you upgrade your python3.11 packages.

    For the detailed security status of python3.11 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python3.11

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing
    and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
    (CVE-2026-18503)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4411-1 advisory.

    - CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of     service via high       CPU usage (bsc#1273148).
    - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
    - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme     (bsc#1276223).
    - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0     (bsc#1276226).
    - CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during     dialect       sniffing and consume significant CPU (bsc#1274683).
    - CVE-2026-19672: The tarfile module's tar and data extraction filters created directories outside the     destination for       members whose name leaves the destination and retu (bsc#1276227).

    Changes for python:

    - Update bundled setuptools wheels to setuptools-40.6.2-py2.py3-none-any.whl (bsc#1276903)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4401-1 advisory.

    Security issues fixed:

    - CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of     service via high       CPU usage (bsc#1273148).
    - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
    - CVE-2026-17084: [Security-announce][] StringPrep algorithm considered (bsc#1276226).
    - CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during     dialect       sniffing and consume significant CPU (bsc#1274683).

    Non security issue fixed:

    - Conflicts between different versions of Python (bsc#1258364).
    - Updated to version 3.13.15

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0969 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-18503:
    Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing     and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2122 advisory.

    Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing     and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
    (CVE-2026-18503)

    `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using     XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag     siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list,     such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match.
    (CVE-2026-6879)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2123 advisory.

    Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing     and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
    (CVE-2026-18503)

    `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using     XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag     siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list,     such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match.
    (CVE-2026-6879)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2124 advisory.

    Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing     and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
    (CVE-2026-18503)

    `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using     XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag     siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list,     such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match.
    (CVE-2026-6879)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2125 advisory.

    Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing     and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
    (CVE-2026-18503)

    `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using     XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag     siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list,     such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match.
    (CVE-2026-6879)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing     and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
    (CVE-2026-18503)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
367741	SUSE SLES12: libpython3_4m1_0 / libpython3_4m1_0-32bit / python3 / python3-base / etc (SUSE-SU-2026:4744-1)	Nessus	SuSE Local Security Checks	Local	high
367738	SUSE SLES12: libpython3_6m1_0 / libpython3_6m1_0-32bit / python36 / etc (SUSE-SU-2026:4743-1)	Nessus	SuSE Local Security Checks	Local	high
365550	SUSE SLES12: libpython2_7-1_0 / libpython2_7-1_0-32bit / python / python-32bit / etc (SUSE-SU-2026:4633-1)	Nessus	SuSE Local Security Checks	Local	high
365491	AlmaLinux 9.2 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791921187)	Nessus	Alma Linux Local Security Checks	Local	low
364182	Debian dla-4827 : idle-python3.11 - security update	Nessus	Debian Local Security Checks	Local	critical
460707	Echo: python3.13: security update to 3.13.5-2+e32	Tenable Cloud Security	Echo Local Security Checks	Local	low
460707	Echo: python3.13: security update to 3.13.5-2+e32	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
362580	SUSE SLES15: libpython2_7-1_0 / python / python-base / python-curses / etc (SUSE-SU-2026:4411-1)	Nessus	SuSE Local Security Checks	Local	high
362493	SUSE SLED15: libpython3_13-1_0 / python313 / python313-base / python313-curses / etc (SUSE-SU-2026:4401-1)	Nessus	SuSE Local Security Checks	Local	high
343521	TencentOS Server 4: python3.11 (TSSA-2026:0969)	Nessus	Tencent Local Security Checks	Local	low
342050	Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-2122)	Nessus	Amazon Linux Local Security Checks	Local	low
342049	Amazon Linux 2023 : python3.13, python3.13-devel, python3.13-freethreading (ALAS2023-2026-2123)	Nessus	Amazon Linux Local Security Checks	Local	low
342048	Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2026-2124)	Nessus	Amazon Linux Local Security Checks	Local	low
341864	Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2026-2125)	Nessus	Amazon Linux Local Security Checks	Local	low
335028	Linux Distros Unpatched Vulnerability : CVE-2026-18503	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-18503

low

Tenable Plugins

high

high

high

low

critical

low

low

high

high

low

low

low

low

low

low