DeepDiff is a project focused on Deep Difference and search of any Python data. From version 5.0.0 to before version 8.6.2, the pickle unpickler _RestrictedUnpickler validates which classes can be loaded but does not limit their constructor arguments. A few of the types in SAFE_TO_IMPORT have constructors that allocate memory proportional to their input (builtins.bytes, builtins.list, builtins.range). A 40-byte pickle payload can force 10+ GB of memory, which crashes applications that load delta objects or call pickle_load with untrusted data. This issue has been patched in version 8.6.2.

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:1094-1 advisory.

    - CVE-2026-33155: Fixed denial of service via builtins.bytes, builtins.list, builtins.range (bsc#1260064).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - DeepDiff is a project focused on Deep Difference and search of any Python data. From version 5.0.0 to     before version 8.6.2, the pickle unpickler _RestrictedUnpickler validates which classes can be loaded but     does not limit their constructor arguments. A few of the types in SAFE_TO_IMPORT have constructors that     allocate memory proportional to their input (builtins.bytes, builtins.list, builtins.range). A 40-byte     pickle payload can force 10+ GB of memory, which crashes applications that load delta objects or call     pickle_load with untrusted data. This issue has been patched in version 8.6.2. (CVE-2026-33155)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - DeepDiff is a project focused on Deep Difference and search of any Python data. From version 5.0.0 to
    before version 8.6.2, the pickle unpickler _RestrictedUnpickler validates which classes can be loaded but
    does not limit their constructor arguments. A few of the types in SAFE_TO_IMPORT have constructors that
    allocate memory proportional to their input (builtins.bytes, builtins.list, builtins.range). A 40-byte
    pickle payload can force 10+ GB of memory, which crashes applications that load delta objects or call
    pickle_load with untrusted data. This issue has been patched in version 8.6.2. (CVE-2026-33155)

ID	Name	Product	Family	Type	Severity
304124	openSUSE 15 Security Update : python-deepdiff (SUSE-SU-2026:1094-1)	Nessus	SuSE Local Security Checks	Local	high
303257	Linux Distros Unpatched Vulnerability : CVE-2026-33155	Nessus	Misc.	Local	high
438993	SCA: security update for deepdiff (GHSA-54jj-px8x-5w5q)	Tenable Cloud Security	SCA Checks	Local	high
438993	SCA: security update for deepdiff (GHSA-54jj-px8x-5w5q)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-33155

high

Tenable Plugins

high

high

high

high