In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3601-1 advisory.

    - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when     the       `configparser` module is used (bsc#1269066).
    - CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting     maliciously       crafted wheel archives (bsc#1257599).
    - CVE-2026-3219: python-pip: pip doesn't reject concatenated ZIP (bsc#1262467).
    - CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing     specially crafted       Unicode input (bsc#1267581).
    - CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when     extracting       hardlinks (bsc#1269959).
    - CVE-2026-6357: pip self-update functionality can import newly installed modules after wheel installation     (bsc#1263442,       bsc#1263443).
    - CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction     directory       (bsc#1267821).
    - CVE-2026-8643: Path traversal via malicious entry point name in pip wheel installation allows arbitrary     file overwrite       (bsc#1266669).
    - CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead     to DoS       (bsc#1269788).
    - CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup     declarations       (bsc#1271192).
    - Fix for CVE-2026-6019 does not handle non-ascii chars correctly. Regression in `http.cookies`     (bsc#1263083).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3569-1 advisory.

    Security issues fixed:

    - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when     the       `configparser` module is used (bsc#1269066).
    - CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing     specially crafted       Unicode input (bsc#1267581).
    - CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when     extracting       hardlinks (bsc#1269959).
    - CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-     flooding       protection (bsc#1264962).
    - CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction     directory       (bsc#1267821).
    - CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address     (bsc#1265268).
    - CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination     directory and       enables arbitrary file reads and writes (bsc#1268977).
    - CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead     to DoS       (bsc#1269788).
    - CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup     declarations       (bsc#1271192).

    Non security issues fixed:

    - [kernel 7.1] udplite was removed -> python fails in tests (bsc#1268375).
    - crypto-policies: Extend the crypto-policies support for mozilla-nss, openjdk, krb5, bind, stunnel,     openssh, libssh and       more packages (bsc#1211301).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3548-1 advisory.

    Security issues fixed:

    - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when     the       `configparser` module is used (bsc#1269066).
    - CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing     specially crafted       Unicode input (bsc#1267581).
    - CVE-2026-4360: in the `Tarfile.extract()` function, the filter parameter is not passed properly when     extracting       hardlinks (bsc#1269959).
    - CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-     flooding       protection (bsc#1264962).
    - CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction     directory       (bsc#1267821).
    - CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address     (bsc#1265268).
    - CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination     directory and       enables arbitrary file reads and writes (bsc#1268977).
    - CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead     to DoS       (bsc#1269788).
    - CVE-2026-15308: incremental `HTMLParser` allows CPU-exhaustion DoS via repeated unterminated markup     declarations       (bsc#1271192).

    Non security issue fixed:

    - Improve testing for the support of `IPPROTO_UDPLITE`, which could be not present although header files     are       (bsc#1268375).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3560-1 advisory.

    Security issues fixed:

    - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when     the       `configparser` module is used (bsc#1269066).
    - CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing     specially crafted       Unicode input (bsc#1267581).
    - CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when     extracting       hardlinks (bsc#1269959).
    - CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-     flooding       protection (bsc#1264962).
    - CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction     directory       (bsc#1267821).
    - CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address     (bsc#1265268).
    - CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination     directory and       enables arbitrary file reads and writes (bsc#1268977).
    - CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead     to DoS       (bsc#1269788).
    - CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup     declarations       (bsc#1271192).

    Non security issue fixed:

    - [kernel 7.1] udplite was removed -> python fails in tests (bsc#1268375).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3530-1 advisory.

    Security issues fixed:

    - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when     the       `configparser` module is used (bsc#1269066).
    - CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing     specially crafted       Unicode input (bsc#1267581).
    - CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when     extracting       hardlinks (bsc#1269959).
    - CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-     flooding       protection (bsc#1264962).
    - CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction     directory       (bsc#1267821).
    - CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address     (bsc#1265268).
    - CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination     directory and       enables arbitrary file reads and writes (bsc#1268977).
    - CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead     to DoS       (bsc#1269788).
    - CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup     declarations       (bsc#1271192).

    Non security issues fixed:

    - [kernel 7.1] udplite was removed -> python fails in tests (bsc#1268375).
    - crypto-policies: Extend the crypto-policies support for mozilla-nss, openjdk, krb5, bind, stunnel,     openssh, libssh and       more packages (bsc#1211301).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1998 advisory.

    CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. (CVE-2026-1502)

    The incremental HTML parser (html.parser.HTMLParser) allows for CPUdenial-of-service through repeated     unterminated markup declarations whenprocessing uncontrolled data. (CVE-2026-15308)

    In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks.
    An affected system that extracts content from untrusted tar files could end up writing files with an     unexpected uid/gid despite the user passing filter='data' to the extract() function. (CVE-2026-4360)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1997 advisory.

    The incremental HTML parser (html.parser.HTMLParser) allows for CPUdenial-of-service through repeated     unterminated markup declarations whenprocessing uncontrolled data. (CVE-2026-15308)

    In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks.
    An affected system that extracts content from untrusted tar files could end up writing files with an     unexpected uid/gid despite the user passing filter='data' to the extract() function. (CVE-2026-4360)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1999 advisory.

    When using the configparser module to write configuration filescontaining multi-line text values with     carriage return characters (\r) theresulting file could be injected with unexpected keys and values if     theattacker controls the written value. (CVE-2026-0864)

    The incremental HTML parser (html.parser.HTMLParser) allows for CPUdenial-of-service through repeated     unterminated markup declarations whenprocessing uncontrolled data. (CVE-2026-15308)

    In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks.
    An affected system that extracts content from untrusted tar files could end up writing files with an     unexpected uid/gid despite the user passing filter='data' to the extract() function. (CVE-2026-4360)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1995 advisory.

    The incremental HTML parser (html.parser.HTMLParser) allows for CPUdenial-of-service through repeated     unterminated markup declarations whenprocessing uncontrolled data. (CVE-2026-15308)

    In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks.
    An affected system that extracts content from untrusted tar files could end up writing files with an     unexpected uid/gid despite the user passing filter='data' to the extract() function. (CVE-2026-4360)

    tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process. (CVE-2026-7774)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1996 advisory.

    The incremental HTML parser (html.parser.HTMLParser) allows for CPUdenial-of-service through repeated     unterminated markup declarations whenprocessing uncontrolled data. (CVE-2026-15308)

    In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks.
    An affected system that extracts content from untrusted tar files could end up writing files with an     unexpected uid/gid despite the user passing filter='data' to the extract() function. (CVE-2026-4360)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks.
    An affected system that extracts content from untrusted tar files could end up writing files with an     unexpected uid/gid despite the user passing filter='data' to the extract() function. (CVE-2026-4360)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
335093	SUSE SLES12: libpython3_4m1_0 / libpython3_4m1_0-32bit / python3 / python3-base / etc (SUSE-SU-2026:3601-1)	Nessus	SuSE Local Security Checks	Local	high
335071	SUSE SLES15: libpython3_12-1_0 / python312 / python312-base / python312-curses / etc (SUSE-SU-2026:3569-1)	Nessus	SuSE Local Security Checks	Local	high
334781	SUSE SLES15: libpython3_11-1_0 / python311 / python311-base / python311-curses / etc (SUSE-SU-2026:3548-1)	Nessus	SuSE Local Security Checks	Local	high
334701	SUSE SLED15: libpython3_11-1_0 / python311 / python311-base / python311-curses / etc (SUSE-SU-2026:3560-1)	Nessus	SuSE Local Security Checks	Local	high
333543	SUSE SLES15: libpython3_10-1_0 / python310 / python310-base / python310-curses / etc (SUSE-SU-2026:3530-1)	Nessus	SuSE Local Security Checks	Local	high
332019	Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2026-1998)	Nessus	Amazon Linux Local Security Checks	Local	high
332013	Amazon Linux 2023 : python3.13, python3.13-devel, python3.13-freethreading (ALAS2023-2026-1997)	Nessus	Amazon Linux Local Security Checks	Local	high
332002	Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-1999)	Nessus	Amazon Linux Local Security Checks	Local	high
331998	Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2026-1995)	Nessus	Amazon Linux Local Security Checks	Local	high
331980	Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2026-1996)	Nessus	Amazon Linux Local Security Checks	Local	high
324686	Linux Distros Unpatched Vulnerability : CVE-2026-4360	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-4360

low

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

low