The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1349-1 advisory.

    - Updated to Python 3.11.15
    - CVE-2025-6075: If the value passed to os.path.expandvars() is user-controlled a performance degradation     is possible when expanding environment variables (bsc#1252974).
    - CVE-2025-11468: header injection when folding a long comment in an email header containing exclusively     unfoldable characters (bsc#1257029).
    - CVE-2025-12084: cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of     service (bsc#1254997).
    - CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined     (bsc#1259611).
    - CVE-2025-13836: When reading an HTTP response from a server, if no read amount is specified, the default     behavior will be to use Content-Length (bsc#1254400).
    - CVE-2025-13837: When loading a plist file, the plistlib module reads data in size specified by the file     itself, meaning a malicious file can cause OOM and DoS issues (bsc#1254401).
    - CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
    - CVE-2026-0672: HTTP header injection via user-controlled cookie values and parameters when using     http.cookies.Morsel (bsc#1257031).
    - CVE-2026-0865: user-controlled header containing newlines can allow injecting HTTP headers     (bsc#1257042).
    - CVE-2026-1299: header injection when an email is serialized due to improper newline quoting in     `BytesGenerator` (bsc#1257181).
    - CVE-2026-2297: cpython: incorrectly handled hook in FileLoader can lead to validation bypass     (bsc#1259240).
    - CVE-2026-3479: python: improper resource argument validation can allow path traversal (bsc#1259989).
    - CVE-2026-3644: incomplete control character validation in http.cookies (bsc#1259734).
    - CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).
    - CVE-2026-4519: leading dashes in URLs are accepted by the `webbrowser.open()` API and allow for web     browser command line option injection (bsc#1260026).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1354-1 advisory.

    - Update to v3.13.13
    - CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined     (bsc#1259611).
    - CVE-2026-2297: cpython: incorrectly handled hook in FileLoader can lead to validation bypass     (bsc#1259240).
    - CVE-2026-3479: python: improper resource argument validation can allow path traversal (bsc#1259989).
    - CVE-2026-3644: incomplete control character validation in http.cookies (bsc#1259734).
    - CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).
    - CVE-2026-4519: leading dashes in URLs are accepted by the `webbrowser.open()` API and allow for web     browser command line option injection (bsc#1260026).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7ea30e843c advisory.

    New prerelease version


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1583 advisory.

    When folding a long comment in an email header containing exclusively unfoldable characters, the     parenthesis would not be preserved. This could be used for injecting headers into email messages where     addresses are user-controlled and not sanitized. (CVE-2025-11468)

    User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in     the data URL mediatype. (CVE-2025-15282)

    When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP     headers into messages. Patch rejects all control characters within cookie names, values, and parameters.
    (CVE-2026-0672)

    User-controlled header names and values containing newlines can allow injecting HTTP headers.
    (CVE-2026-0865)

    The email module, specifically the BytesGenerator class, didn't properly quote newlines for email     headers when serializing an email message allowing for header injection when an email is serialized. This     is only applicable if using LiteralHeader writing headers that don't respect email folding rules, the     new behavior will reject the incorrectly folded headers in BytesGenerator. (CVE-2026-1299)

    The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled     in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers     for this audit event therefore do not fire. (CVE-2026-2297)

    When an Expat parser with a registered ElementDeclHandler parses an inlinedocument type definition     containing a deeply nested content model a C stackoverflow occurs. (CVE-2026-4224)

    The webbrowser.open() API would accept leading dashes in the URL whichcould be handled as command line     options for certain web browsers. Newbehavior rejects leading dashes. Users are recommended to sanitize     URLsprior to passing to webbrowser.open(). (CVE-2026-4519)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-22d8c9f967 advisory.

    Update to python-3.11.15, backport fixes for CVE-2026-4519, CVE-2026-3644, CVE-2026-4224, CVE-2026-2297

    ----

    Update to python-3.11.15.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ff5da930eb advisory.

    Update to python-3.11.15, backport fixes for CVE-2026-4519, CVE-2026-3644, CVE-2026-4224, CVE-2026-2297

    ----

    Update to python-3.11.15.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1117-1 advisory.

    Update to python 3.11.15:

    - CVE-2025-6075: quadratic complexity in os.path.expandvars() (bsc#1252974).
    - CVE-2025-11468: header injection with carefully crafted inputs (bsc#1257029).
    - CVE-2025-12084: quadratic complexity in xml.minidom node ID cache clearing (bsc#1254997).
    - CVE-2025-13836: potential memory denial of service in the http.client module (bsc#1254400).
    - CVE-2025-13837: potential memory denial of service in the plistlib module (bsc#1254401).
    - CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
    - CVE-2026-0672: control characters in http.cookies.Morsel fields and values (bsc#1257031).
    - CVE-2026-0865: C0 control characters within wsgiref.headers.Headers fields, values, and parameters     (bsc#1257042).
    - CVE-2026-1299: header injection when an email is serialized due to improper newline quoting     (bsc#1257181).
    - CVE-2026-2297: validation bypass via incorrectly handled hook in FileLoader (bsc#1259240).

    Changelog:

     - gh-144125: BytesGenerator will now refuse to serialize      (write) headers that are unsafely folded or delimited; see      verify_generated_headers. (Contributed by Bas Bloemsaat and      Petr Viktorin in gh-121650) (bsc#1257181, CVE-2026-1299).
     - gh-143935: Fixed a bug in the folding of comments when      flattening an email message using a modern email policy.
     Comments consisting of a very long sequence of non-foldable      characters could trigger a forced line wrap that omitted      the required leading space on the continuation line,      causing the remainder of the comment to be interpreted as      a new header field. This enabled header injection with      carefully crafted inputs (bsc#1257029 CVE-2025-11468).
     - gh-143925: Reject control characters in data: URL media      types (bsc#1257046, CVE-2025-15282).
     - gh-143919: Reject control characters in http.cookies.Morsel      fields and values (bsc#1257031, CVE-2026-0672).
     - gh-143916: Reject C0 control characters within      wsgiref.headers.Headers fields, values, and parameters      (bsc#1257042, CVE-2026-0865).
     - gh-142145: Remove quadratic behavior in xml.minidom node ID      cache clearing. In order to do this without breaking      existing users, we also add the ownerDocument attribute to      xml.dom.minidom elements and attributes created by directly      instantiating the Element or Attr class. Note that this way      of creating nodes is not supported; creator functions like      xml.dom.Document.documentElement() should be used instead      (bsc#1254997, CVE-2025-12084).
     - gh-137836: Add support of the 'plaintext' element, RAWTEXT      elements 'xmp', 'iframe', 'noembed' and 'noframes', and      optionally RAWTEXT element 'noscript' in      html.parser.HTMLParser.
     - gh-136063: email.message: ensure linear complexity for      legacy HTTP parameters parsing. Patch by B?n?dikt Tran.
     - gh-136065: Fix quadratic complexity in      os.path.expandvars() (bsc#1252974, CVE-2025-6075).
     - gh-119451: Fix a potential memory denial of service in the      http.client module. When connecting to a malicious server,      it could cause an arbitrary amount of memory to be      allocated. This could have led to symptoms including      a MemoryError, swapping, out of memory (OOM) killed      processes or containers, or even system crashes      (CVE-2025-13836, bsc#1254400).
     - gh-119452: Fix a potential memory denial of service in the      http.server module. When a malicious user is connected to      the CGI server on Windows, it could cause an arbitrary      amount of memory to be allocated. This could have led to      symptoms including a MemoryError, swapping, out of memory      (OOM) killed processes or containers, or even system      crashes.
     - gh-119342: Fix a potential memory denial of service in the      plistlib module. When reading a Plist file received from      untrusted source, it could cause an arbitrary amount of      memory to be allocated. This could have led to symptoms      including a MemoryError, swapping, out of memory (OOM)      killed processes or containers, or even system crashes      (bsc#1254401, CVE-2025-13837).
     - Library
     - gh-144833: Fixed a use-after-free in ssl when SSL_new()      returns NULL in newPySSLSocket(). The error was reported      via a dangling pointer after the object had already been      freed.
     - gh-144363: Update bundled libexpat to 2.7.4
     - gh-90949: Add SetAllocTrackerActivationThreshold() and      SetAllocTrackerMaximumAmplification() to xmlparser objects      to prevent use of disproportional amounts of dynamic memory      from within an Expat parser. Patch by B?n?dikt Tran.
     - Core and Builtins
     - gh-120384: Fix an array out of bounds crash in      list_ass_subscript, which could be invoked via some      specificly tailored input: including concurrent      modification of a list object, where one thread assigns      a slice and another clears it.
     - gh-120298: Fix use-after free in list_richcompare_impl      which can be invoked via some specificly tailored evil      input.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1107-1 advisory.

    Update to Python 3.12.13:

    - CVE-2025-6075: quadratic complexity in os.path.expandvars() (bsc#1252974).
    - CVE-2025-11468: header injection with carefully crafted inputs (bsc#1257029).
    - CVE-2025-12084: quadratic complexity in xml.minidom node ID cache clearing (bsc#1254997).
    - CVE-2025-13836: potential memory denial of service in the http.client module (bsc#1254400).
    - CVE-2025-13837: potential memory denial of service in the plistlib module (bsc#1254401).
    - CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
    - CVE-2026-0672: control characters in http.cookies.Morsel fields and values (bsc#1257031).
    - CVE-2026-0865: C0 control characters within wsgiref.headers.Headers fields, values, and parameters     (bsc#1257042).
    - CVE-2026-1299: header injection when an email is serialized due to improper newline quoting     (bsc#1257181).
    - CVE-2026-2297: validation bypass via incorrectly handled hook in FileLoader (bsc#1259240).

    Changelog:
     - gh-144125: BytesGenerator will now refuse to serialize      (write) headers that are unsafely folded or delimited; see      verify_generated_headers. (Contributed by Bas Bloemsaat and      Petr Viktorin in gh-121650) (bsc#1257181, CVE-2026-1299).
     - gh-143935: Fixed a bug in the folding of comments when      flattening an email message using a modern email policy.
     Comments consisting of a very long sequence of non-foldable      characters could trigger a forced line wrap that omitted      the required leading space on the continuation line,      causing the remainder of the comment to be interpreted as      a new header field. This enabled header injection with      carefully crafted inputs (bsc#1257029 CVE-2025-11468).
     - gh-143925: Reject control characters in data: URL media      types (bsc#1257046, CVE-2025-15282).
     - gh-143919: Reject control characters in http.cookies.Morsel      fields and values (bsc#1257031, CVE-2026-0672).
     - gh-143916: Reject C0 control characters within      wsgiref.headers.Headers fields, values, and parameters      (bsc#1257042, CVE-2026-0865).
     - gh-142145: Remove quadratic behavior in xml.minidom node ID      cache clearing. In order to do this without breaking      existing users, we also add the ownerDocument attribute to      xml.dom.minidom elements and attributes created by directly      instantiating the Element or Attr class. Note that this way      of creating nodes is not supported; creator functions like      xml.dom.Document.documentElement() should be used instead      (bsc#1254997, CVE-2025-12084).
     - gh-137836: Add support of the 'plaintext' element, RAWTEXT      elements 'xmp', 'iframe', 'noembed' and 'noframes', and      optionally RAWTEXT element 'noscript' in      html.parser.HTMLParser.
     - gh-136063: email.message: ensure linear complexity for      legacy HTTP parameters parsing. Patch by B?n?dikt Tran.
     - gh-136065: Fix quadratic complexity in      os.path.expandvars() (bsc#1252974, CVE-2025-6075).
     - gh-119451: Fix a potential memory denial of service in the      http.client module. When connecting to a malicious server,      it could cause an arbitrary amount of memory to be      allocated. This could have led to symptoms including      a MemoryError, swapping, out of memory (OOM) killed      processes or containers, or even system crashes      (CVE-2025-13836, bsc#1254400).
     - gh-119452: Fix a potential memory denial of service in the      http.server module. When a malicious user is connected to      the CGI server on Windows, it could cause an arbitrary      amount of memory to be allocated. This could have led to      symptoms including a MemoryError, swapping, out of memory      (OOM) killed processes or containers, or even system      crashes.
     - gh-119342: Fix a potential memory denial of service in the      plistlib module. When reading a Plist file received from      untrusted source, it could cause an arbitrary amount of      memory to be allocated. This could have led to symptoms      including a MemoryError, swapping, out of memory (OOM)      killed processes or containers, or even system crashes      (bsc#1254401, CVE-2025-13837).
     - Library
     - gh-144833: Fixed a use-after-free in ssl when SSL_new()      returns NULL in newPySSLSocket(). The error was reported      via a dangling pointer after the object had already been      freed.
     - gh-144363: Update bundled libexpat to 2.7.4
     - gh-90949: Add SetAllocTrackerActivationThreshold() and      SetAllocTrackerMaximumAmplification() to xmlparser objects      to prevent use of disproportional amounts of dynamic memory      from within an Expat parser. Patch by B?n?dikt Tran.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1062-1 advisory.

    Update to Python 3.10.20:

    - CVE-2025-6075: quadratic complexity in os.path.expandvars() (bsc#1252974).
    - CVE-2025-11468: header injection with carefully crafted inputs (bsc#1257029).
    - CVE-2025-12084: quadratic complexity in xml.minidom node ID cache clearing (bsc#1254997).
    - CVE-2025-13836: potential memory denial of service in the http.client module (bsc#1254400).
    - CVE-2025-13837: potential memory denial of service in the plistlib module (bsc#1254401).
    - CVE-2026-0672: control characters in http.cookies.Morsel fields and values (bsc#1257031).
    - CVE-2026-0865: C0 control characters within wsgiref.headers.Headers fields, values, and parameters     (bsc#1257042).
    - CVE-2026-1299: header injection when an email is serialized due to improper newline quoting     (bsc#1257181).
    - CVE-2026-2297: validation bypass via incorrectly handled hook in FileLoader (bsc#1259240).

    Changelog:

    - Update to 3.10.20:
     - gh-144125: BytesGenerator will now refuse to serialize      (write) headers that are unsafely folded or delimited; see      verify_generated_headers. (Contributed by Bas Bloemsaat and      Petr Viktorin in gh-121650) (bsc#1257181, CVE-2026-1299).
     - gh-143935: Fixed a bug in the folding of comments when      flattening an email message using a modern email policy.
     Comments consisting of a very long sequence of non-foldable      characters could trigger a forced line wrap that omitted      the required leading space on the continuation line,      causing the remainder of the comment to be interpreted as      a new header field. This enabled header injection with      carefully crafted inputs (bsc#1257029 CVE-2025-11468).
     - gh-143925: Reject control characters in data: URL media      types.
     - gh-143919: Reject control characters in http.cookies.Morsel      fields and values (bsc#1257031, CVE-2026-0672).
     - gh-143916: Reject C0 control characters within      wsgiref.headers.Headers fields, values, and parameters      (bsc#1257042, CVE-2026-0865).
     - gh-142145: Remove quadratic behavior in xml.minidom node ID      cache clearing. In order to do this without breaking      existing users, we also add the ownerDocument attribute to      xml.dom.minidom elements and attributes created by directly      instantiating the Element or Attr class. Note that this way      of creating nodes is not supported; creator functions like      xml.dom.Document.documentElement() should be used instead      (bsc#1254997, CVE-2025-12084).
     - gh-137836: Add support of the 'plaintext' element, RAWTEXT      elements 'xmp', 'iframe', 'noembed' and 'noframes', and      optionally RAWTEXT element 'noscript' in      html.parser.HTMLParser.
     - gh-136063: email.message: ensure linear complexity for      legacy HTTP parameters parsing. Patch by B?n?dikt Tran.
     - gh-136065: Fix quadratic complexity in      os.path.expandvars() (bsc#1252974, CVE-2025-6075).
     - gh-119451: Fix a potential memory denial of service in the      http.client module. When connecting to a malicious server,      it could cause an arbitrary amount of memory to be      allocated. This could have led to symptoms including      a MemoryError, swapping, out of memory (OOM) killed      processes or containers, or even system crashes      (CVE-2025-13836, bsc#1254400).
     - gh-119452: Fix a potential memory denial of service in the      http.server module. When a malicious user is connected to      the CGI server on Windows, it could cause an arbitrary      amount of memory to be allocated. This could have led to      symptoms including a MemoryError, swapping, out of memory      (OOM) killed processes or containers, or even system      crashes.
     - gh-119342: Fix a potential memory denial of service in the      plistlib module. When reading a Plist file received from      untrusted source, it could cause an arbitrary amount of      memory to be allocated. This could have led to symptoms      including a MemoryError, swapping, out of memory (OOM)      killed processes or containers, or even system crashes      (bsc#1254401, CVE-2025-13837).
     - Library
     - gh-144833: Fixed a use-after-free in ssl when SSL_new()      returns NULL in newPySSLSocket(). The error was reported      via a dangling pointer after the object had already been      freed.
     - gh-144363: Update bundled libexpat to 2.7.4
     - gh-90949: Add SetAllocTrackerActivationThreshold() and      SetAllocTrackerMaximumAmplification() to xmlparser objects      to prevent use of disproportional amounts of dynamic memory      from within an Expat parser. Patch by B?n?dikt Tran.
     - Core and Builtins
     - gh-120384: Fix an array out of bounds crash in      list_ass_subscript, which could be invoked via some      specificly tailored input: including concurrent      modification of a list object, where one thread assigns      a slice and another clears it.
     - gh-120298: Fix use-after free in list_richcompare_impl      which can be invoked via some specificly tailored evil      input.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:0971-1 advisory.

    This update for python39 fixes the following issue:

    - CVE-2026-2297: validation bypass via incorrectly handled hook in FileLoader (bsc#1259240).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled     in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers     for this audit event therefore do not fire. (CVE-2026-2297)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
306693	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python311 (SUSE-SU-2026:1349-1)	Nessus	SuSE Local Security Checks	high
306689	SUSE SLED15 / SLES15 Security Update : python313 (SUSE-SU-2026:1354-1)	Nessus	SuSE Local Security Checks	high
306619	Fedora 43 : python3.15 (2026-7ea30e843c)	Nessus	Fedora Local Security Checks	high
306206	Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2026-1583)	Nessus	Amazon Linux Local Security Checks	high
305025	Fedora 43 : mingw-python3 (2026-22d8c9f967)	Nessus	Fedora Local Security Checks	high
305021	Fedora 42 : mingw-python3 (2026-ff5da930eb)	Nessus	Fedora Local Security Checks	high
304133	SUSE SLES15 Security Update : python311 (SUSE-SU-2026:1117-1)	Nessus	SuSE Local Security Checks	medium
304121	SUSE SLES15 / openSUSE 15 Security Update : python312 (SUSE-SU-2026:1107-1)	Nessus	SuSE Local Security Checks	medium
303953	SUSE SLES15 / openSUSE 15 Security Update : python310 (SUSE-SU-2026:1062-1)	Nessus	SuSE Local Security Checks	medium
303393	openSUSE 15 Security Update : python39 (SUSE-SU-2026:0971-1)	Nessus	SuSE Local Security Checks	medium
301038	Linux Distros Unpatched Vulnerability : CVE-2026-2297	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-2297

medium

Tenable Plugins

high

high

high

high

high

high

medium

medium

medium

medium

medium