WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP Location header during a redirect is vulnerable to an open redirect: WebOb joins the redirect target to the request URI using Python's urljoin, and since Python 3.10 the underlying urlsplit strips ASCII tab, carriage return, and newline characters before parsing, so a redirect target containing such characters can be reinterpreted as a protocol-relative URL whose authority is an attacker-controlled host. This bypasses the CVE-2024-42353 fix that escaped a leading double slash, allowing an attacker who influences the redirect location to send users to an arbitrary external site instead of the intended one. This vulnerability is fixed in 1.8.10.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8759-1 advisory.

    It was discovered that WebOb incorrectly handled certain URLs. An attacker could possibly use this issue     to control a redirect or forward to another URL. This issue was only addressed in Ubuntu 16.04 LTS and     Ubuntu 18.04 LTS. (CVE-2024-42353)

    Caleb Brown discovered that WebOb incorrectly handled certain URLs. An attacker could possibly use this     issue to control a redirect or forward to another URL. (CVE-2026-44889)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2982-1 advisory.

    This update for python-WebOb fixes the following issue

    - CVE-2026-44889: Location header normalization during redirect leads to open redirect (bsc#1268324).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of CBL-Mariner Releases installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-44889 advisory.

  - WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP     Location header during a redirect is vulnerable to an open redirect: WebOb joins the redirect target to     the request URI using Python's urljoin, and since Python 3.10 the underlying urlsplit strips ASCII tab,     carriage return, and newline characters before parsing, so a redirect target containing such characters     can be reinterpreted as a protocol-relative URL whose authority is an attacker-controlled host. This     bypasses the CVE-2024-42353 fix that escaped a leading double slash, allowing an attacker who influences     the redirect location to send users to an arbitrary external site instead of the intended one. This     vulnerability is fixed in 1.8.10. (CVE-2026-44889)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:22370-1 advisory.

    Changes in python-Markdown:

    - Fix tests with latest python version (bsc#1268243)

    Changes in python-joblib:

    - Update to 1.5.2:
        * fixing the resource tracker for python 3.13.7+
        * Skip tests failing with Python 3.13.7

    Changes in python-handy-archives:

    - Skip some zip64 tests that fails with latest python interpreter       because there are more consistency checks in zipfile (bsc#1256310)

    Changes in python-apache-libcloud:

    - Fix tests compatibility with latest Python 3.13 (bsc#1258223, bsc#1261918)

    Changes in python-WebOb:

    - Security issues fixed:
        * CVE-2026-44889: Fixed: Location header normalization during redirect leads           to open redirect (bsc#1268324)
    - Skip boken test with latest cpython interpreters  (bsc#1258223)
    - Skip test failing on Python 3.14

    Changes in python-PyGithub:

    - Fix: [SUSE:SLFO:Main] python-PyGithub fails to build on aarch64, ppc64le, s390x, x86_64 (bsc#1263802)

    Changes in python-soupsieve:

    - Fix: [SUSE:SLFO:Main] python-soupsieve:test fails to build on aarch64, ppc64le, s390x, x86_64     (bsc#1256316)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21063-1 advisory.

    Changes in python-Markdown:

    - Fix tests with latest python version (bsc#1268243)

    Changes in python-joblib:

    - Update to 1.5.2:
        * fixing the resource tracker for python 3.13.7+
        * Skip tests failing with Python 3.13.7

    Changes in python-handy-archives:

    - Skip some zip64 tests that fails with latest python interpreter       because there are more consistency checks in zipfile (bsc#1256310)

    Changes in python-apache-libcloud:

    - Fix tests compatibility with latest Python 3.13 (bsc#1258223, bsc#1261918)

    Changes in python-WebOb:

    - Security issues fixed:
        * CVE-2026-44889: Fixed: Location header normalization during redirect leads           to open redirect (bsc#1268324)
    - Skip boken test with latest cpython interpreters  (bsc#1258223)
    - Skip test failing on Python 3.14

    Changes in python-PyGithub:

    - Fix: [SUSE:SLFO:Main] python-PyGithub fails to build on aarch64, ppc64le, s390x, x86_64 (bsc#1263802)

    Changes in python-soupsieve:

    - Fix: [SUSE:SLFO:Main] python-soupsieve:test fails to build on aarch64, ppc64le, s390x, x86_64     (bsc#1256316)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP     Location header during a redirect is vulnerable to an open redirect: WebOb joins the redirect target to     the request URI using Python's urljoin, and since Python 3.10 the underlying urlsplit strips ASCII tab,     carriage return, and newline characters before parsing, so a redirect target containing such characters     can be reinterpreted as a protocol-relative URL whose authority is an attacker-controlled host. This     bypasses the CVE-2024-42353 fix that escaped a leading double slash, allowing an attacker who influences     the redirect location to send users to an arbitrary external site instead of the intended one. This     vulnerability is fixed in 1.8.10. (CVE-2026-44889)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP
    Location header during a redirect is vulnerable to an open redirect: WebOb joins the redirect target to
    the request URI using Python's urljoin, and since Python 3.10 the underlying urlsplit strips ASCII tab,
    carriage return, and newline characters before parsing, so a redirect target containing such characters
    can be reinterpreted as a protocol-relative URL whose authority is an attacker-controlled host. This
    bypasses the CVE-2024-42353 fix that escaped a leading double slash, allowing an attacker who influences
    the redirect location to send users to an arbitrary external site instead of the intended one. This
    vulnerability is fixed in 1.8.10. (CVE-2026-44889)

ID	Name	Product	Family	Type	Severity
346811	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : WebOb vulnerabilities (USN-8759-1)	Nessus	Ubuntu Local Security Checks	Local	medium
326973	SUSE SLED15 / SLES15 Security Update : python-WebOb (SUSE-SU-2026:2982-1)	Nessus	SuSE Local Security Checks	Local	medium
324920	Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2026-44889)	Nessus	Azure Linux Local Security Checks	Local	medium
324864	SUSE SLES16: python-WebOb-doc / python313-Markdown / python313-PyGithub / etc (SUSE-SU-2026:22370-1)	Nessus	SuSE Local Security Checks	Local	medium
324055	openSUSE 16: python313-Markdown / python313-PyGithub / python313-WebOb / etc (openSUSE-SU-2026:21063-1)	Nessus	SuSE Local Security Checks	Local	medium
322297	Linux Distros Unpatched Vulnerability : CVE-2026-44889	Nessus	Misc.	Local	medium
442641	SCA: security update for webob (GHSA-fh3h-vg37-cc95)	Tenable Cloud Security	SCA Checks	Local	medium
442641	SCA: security update for webob (GHSA-fh3h-vg37-cc95)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-44889

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium