unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3530-1 advisory.

    Security issues fixed:

    - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when     the       `configparser` module is used (bsc#1269066).
    - CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing     specially crafted       Unicode input (bsc#1267581).
    - CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when     extracting       hardlinks (bsc#1269959).
    - CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-     flooding       protection (bsc#1264962).
    - CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction     directory       (bsc#1267821).
    - CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address     (bsc#1265268).
    - CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination     directory and       enables arbitrary file reads and writes (bsc#1268977).
    - CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead     to DoS       (bsc#1269788).
    - CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup     declarations       (bsc#1271192).

    Non security issues fixed:

    - [kernel 7.1] udplite was removed -> python fails in tests (bsc#1268375).
    - crypto-policies: Extend the crypto-policies support for mozilla-nss, openjdk, krb5, bind, stunnel,     openssh, libssh and       more packages (bsc#1211301).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1954 advisory.

    When using the configparser module to write configuration filescontaining multi-line text values with     carriage return characters (\r) theresulting file could be injected with unexpected keys and values if     theattacker controls the written value. (CVE-2026-0864)

    When using the tarfile module with a file opened in streaming mode (mode=r|) the tarfile module did     not properly handle EOF, making archive parsing take exponentially longer. (CVE-2026-11972)

    CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. (CVE-2026-1502)

    unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input     containing long runs of combining characters with alternating Canonical Combining Class values. This     affects all normalization forms. (CVE-2026-3276)

    tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process. (CVE-2026-7774)

    bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data. (CVE-2026-9669)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1963 advisory.

    When using the configparser module to write configuration filescontaining multi-line text values with     carriage return characters (\r) theresulting file could be injected with unexpected keys and values if     theattacker controls the written value. (CVE-2026-0864)

    tarfile.extractall() with the 'data' or 'tar'filter could be bypassed by a crafted archive where a     hardlinkreferences a symlink stored at a deeper name than the hardlink itself.The extraction fallback     validated the symlink at it's archived locationbut recreated it at the hardlink's shallowerpath, letting a     relativetarget the filter judged contained escape the destination directory.This allowed a malicious tar     archive to create a symlink pointingoutside the destination, enabling out-of-destination file reads     orwrites. This was an incomplete fix of CVE-2025-4330. (CVE-2026-11940)

    When using the tarfile module with a file opened in streaming mode (mode=r|) the tarfile module did     not properly handle EOF, making archive parsing take exponentially longer. (CVE-2026-11972)

    unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input     containing long runs of combining characters with alternating Canonical Combining Class values. This     affects all normalization forms. (CVE-2026-3276)

    bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data. (CVE-2026-9669)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1953 advisory.

    When using the configparser module to write configuration filescontaining multi-line text values with     carriage return characters (\r) theresulting file could be injected with unexpected keys and values if     theattacker controls the written value. (CVE-2026-0864)

    When using the tarfile module with a file opened in streaming mode (mode=r|) the tarfile module did     not properly handle EOF, making archive parsing take exponentially longer. (CVE-2026-11972)

    unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input     containing long runs of combining characters with alternating Canonical Combining Class values. This     affects all normalization forms. (CVE-2026-3276)

    tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process. (CVE-2026-7774)

    bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data. (CVE-2026-9669)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1910 advisory.

    tarfile.extractall() with the 'data' or 'tar'filter could be bypassed by a crafted archive where a     hardlinkreferences a symlink stored at a deeper name than the hardlink itself.The extraction fallback     validated the symlink at it's archived locationbut recreated it at the hardlink's shallowerpath, letting a     relativetarget the filter judged contained escape the destination directory.This allowed a malicious tar     archive to create a symlink pointingoutside the destination, enabling out-of-destination file reads     orwrites. This was an incomplete fix of CVE-2025-4330. (CVE-2026-11940)

    CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. (CVE-2026-1502)

    unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input     containing long runs of combining characters with alternating Canonical Combining Class values. This     affects all normalization forms. (CVE-2026-3276)

    `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding     protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this     vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch. (CVE-2026-7210)

    tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process. (CVE-2026-7774)

    The ftpcp() function in Lib/ftplib.py was not updated whenCVE-2021-4189 was fixed. While makepasv() was     patched to replaceserver-supplied PASV host addresses with the actual peer address(getpeername()[0]),     ftpcp() still calls parse227() directly and passesthe raw attacker-controllable IP address and port to     target.sendport(). This patch is related to CVE-2021-4189. (CVE-2026-8328)

    bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data. (CVE-2026-9669)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1929 advisory.

    tarfile.extractall() with the 'data' or 'tar'filter could be bypassed by a crafted archive where a     hardlinkreferences a symlink stored at a deeper name than the hardlink itself.The extraction fallback     validated the symlink at it's archived locationbut recreated it at the hardlink's shallowerpath, letting a     relativetarget the filter judged contained escape the destination directory.This allowed a malicious tar     archive to create a symlink pointingoutside the destination, enabling out-of-destination file reads     orwrites. This was an incomplete fix of CVE-2025-4330. (CVE-2026-11940)

    unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input     containing long runs of combining characters with alternating Canonical Combining Class values. This     affects all normalization forms. (CVE-2026-3276)

    tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process. (CVE-2026-7774)

    The ftpcp() function in Lib/ftplib.py was not updated whenCVE-2021-4189 was fixed. While makepasv() was     patched to replaceserver-supplied PASV host addresses with the actual peer address(getpeername()[0]),     ftpcp() still calls parse227() directly and passesthe raw attacker-controllable IP address and port to     target.sendport(). This patch is related to CVE-2021-4189. (CVE-2026-8328)

    bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data. (CVE-2026-9669)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8509-1 advisory.

    It was discovered that Python incorrectly normalized paths in the tarfile module. An attacker could     possibly use this issue to bypass path restrictions. This issue only affected Ubuntu 22.04 LTS and Ubuntu     24.04 LTS. (CVE-2025-13462)

    It was discovered that Python's HTMLParser incorrectly handled certain malformed HTML input. An attacker     could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only     affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-69534)

    It was discovered that Python's email module incorrectly quoted newlines in headers. An attacker could     possibly use this issue to inject arbitrary email headers. This issue only affected Ubuntu 22.04 LTS and     Ubuntu 24.04 LTS. (CVE-2026-1299)

    It was discovered that Python's http.client module did not properly sanitize carriage return and linefeed     characters when handling HTTP CONNECT tunnel request headers. An attacker could possibly use this issue to     inject arbitrary HTTP headers. (CVE-2026-1502)

    It was discovered that Python's importlib module did not generate an audit event when loading legacy .pyc     files. An attacker could possibly use this issue to bypass auditing mechanisms. This issue only affected     Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-2297)

    It was discovered that Python's unicodedata.normalize() function had incorrect algorithmic complexity. An     attacker could possibly use this issue to cause Python to consume excessive resources, leading to a denial     of service. (CVE-2026-3276)

    It was discovered that Python's http.cookies module incorrectly handled control characters in certain     cookie operations. An attacker could possibly use this issue to inject arbitrary content. This issue only     affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-3644)

    It was discovered that the Python pyexpat module was vulnerable to unbounded recursion in the Expat XML     parser. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of     service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4224)

    It was discovered that Python's webbrowser module accepted leading dashes in URLs, which could be     interpreted as command-line options. An attacker could possibly use this issue to execute arbitrary     commands. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4519)

    It was discovered that Python incorrectly handled webbrowser.open() handlers. An attacker could possibly     use this issue to execute arbitrary commands. (CVE-2026-4786)

    It was discovered that Python's remote debugging module did not properly validate offset tables when     loading debug information. An attacker could possibly use this issue to cause Python to crash or execute     arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-5713)

    It was discovered that Python's http.cookies module incorrectly escaped values in the js_output() method.
    An attacker could possibly use this issue to inject arbitrary JavaScript. (CVE-2026-6019)

    It was discovered that Python's lzma, bz2, and gzip decompressor objects had a use-after-free     vulnerability. An attacker could possibly use this issue to cause Python to crash or execute arbitrary     code. (CVE-2026-6100)

    It was discovered that Python's tarfile module did not properly validate link targets when using the data     filter. An attacker could possibly use this issue to bypass path restrictions. This issue only affected     Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-7774)

    It was discovered that the fix for CVE-2021-4189 in Python's ftplib module was incomplete, allowing PASV     responses to be used in ftplib.ftpcp(). An attacker could possibly use this issue to perform server-side     request forgery attacks. (CVE-2026-8328)

    It was discovered that Python's bz2 module allowed reuse of a BZ2Decompressor object after a decompression     error. An attacker could possibly use this issue to cause Python to crash or execute arbitrary code.
    (CVE-2026-9669)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-b17b2a984a advisory.

    New Python release including bugfixes and security fixes.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-a2c583a4ab advisory.

    New Python release including bugfixes and security fixes.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dfc9182263 advisory.

    New Python version including bugfixes and security fixes.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2deb979d80 advisory.

    New Python release including bugfixes and security fixes.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input     containing long runs of combining characters with alternating Canonical Combining Class values. This     affects all normalization forms. (CVE-2026-3276)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
333543	SUSE SLES15: libpython3_10-1_0 / python310 / python310-base / python310-curses / etc (SUSE-SU-2026:3530-1)	Nessus	SuSE Local Security Checks	high
328487	Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2026-1954)	Nessus	Amazon Linux Local Security Checks	high
328474	Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2026-1963)	Nessus	Amazon Linux Local Security Checks	high
328461	Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2026-1953)	Nessus	Amazon Linux Local Security Checks	high
327378	Amazon Linux 2023 : python3.13, python3.13-devel, python3.13-freethreading (ALAS2023-2026-1910)	Nessus	Amazon Linux Local Security Checks	high
327372	Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-1929)	Nessus	Amazon Linux Local Security Checks	high
325428	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Python vulnerabilities (USN-8509-1)	Nessus	Ubuntu Local Security Checks	critical
323276	Fedora 43 : python3-docs / python3.14 (2026-b17b2a984a)	Nessus	Fedora Local Security Checks	medium
322120	Fedora 44 : python3-docs / python3.14 (2026-a2c583a4ab)	Nessus	Fedora Local Security Checks	medium
321848	Fedora 44 : python3.13 (2026-dfc9182263)	Nessus	Fedora Local Security Checks	critical
321844	Fedora 43 : python3.13 (2026-2deb979d80)	Nessus	Fedora Local Security Checks	critical
318548	Linux Distros Unpatched Vulnerability : CVE-2026-3276	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-3276

medium

Tenable Plugins

high

high

high

high

high

high

critical

medium

medium

critical

critical

medium