WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP Location header during a redirect is vulnerable to an open redirect: WebOb joins the redirect target to the request URI using Python's urljoin, and since Python 3.10 the underlying urlsplit strips ASCII tab, carriage return, and newline characters before parsing, so a redirect target containing such characters can be reinterpreted as a protocol-relative URL whose authority is an attacker-controlled host. This bypasses the CVE-2024-42353 fix that escaped a leading double slash, allowing an attacker who influences the redirect location to send users to an arbitrary external site instead of the intended one. This vulnerability is fixed in 1.8.10.

The version of CBL-Mariner Releases installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-44889 advisory.

  - WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP     Location header during a redirect is vulnerable to an open redirect: WebOb joins the redirect target to     the request URI using Python's urljoin, and since Python 3.10 the underlying urlsplit strips ASCII tab,     carriage return, and newline characters before parsing, so a redirect target containing such characters     can be reinterpreted as a protocol-relative URL whose authority is an attacker-controlled host. This     bypasses the CVE-2024-42353 fix that escaped a leading double slash, allowing an attacker who influences     the redirect location to send users to an arbitrary external site instead of the intended one. This     vulnerability is fixed in 1.8.10. (CVE-2026-44889)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:22370-1 advisory.

    Changes in python-Markdown:

    - Fix tests with latest python version (bsc#1268243)

    Changes in python-joblib:

    - Update to 1.5.2:
        * fixing the resource tracker for python 3.13.7+
        * Skip tests failing with Python 3.13.7

    Changes in python-handy-archives:

    - Skip some zip64 tests that fails with latest python interpreter       because there are more consistency checks in zipfile (bsc#1256310)

    Changes in python-apache-libcloud:

    - Fix tests compatibility with latest Python 3.13 (bsc#1258223, bsc#1261918)

    Changes in python-WebOb:

    - Security issues fixed:
        * CVE-2026-44889: Fixed: Location header normalization during redirect leads           to open redirect (bsc#1268324)
    - Skip boken test with latest cpython interpreters  (bsc#1258223)
    - Skip test failing on Python 3.14

    Changes in python-PyGithub:

    - Fix: [SUSE:SLFO:Main] python-PyGithub fails to build on aarch64, ppc64le, s390x, x86_64 (bsc#1263802)

    Changes in python-soupsieve:

    - Fix: [SUSE:SLFO:Main] python-soupsieve:test fails to build on aarch64, ppc64le, s390x, x86_64     (bsc#1256316)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21063-1 advisory.

    Changes in python-Markdown:

    - Fix tests with latest python version (bsc#1268243)

    Changes in python-joblib:

    - Update to 1.5.2:
        * fixing the resource tracker for python 3.13.7+
        * Skip tests failing with Python 3.13.7

    Changes in python-handy-archives:

    - Skip some zip64 tests that fails with latest python interpreter       because there are more consistency checks in zipfile (bsc#1256310)

    Changes in python-apache-libcloud:

    - Fix tests compatibility with latest Python 3.13 (bsc#1258223, bsc#1261918)

    Changes in python-WebOb:

    - Security issues fixed:
        * CVE-2026-44889: Fixed: Location header normalization during redirect leads           to open redirect (bsc#1268324)
    - Skip boken test with latest cpython interpreters  (bsc#1258223)
    - Skip test failing on Python 3.14

    Changes in python-PyGithub:

    - Fix: [SUSE:SLFO:Main] python-PyGithub fails to build on aarch64, ppc64le, s390x, x86_64 (bsc#1263802)

    Changes in python-soupsieve:

    - Fix: [SUSE:SLFO:Main] python-soupsieve:test fails to build on aarch64, ppc64le, s390x, x86_64     (bsc#1256316)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP     Location header during a redirect is vulnerable to an open redirect: WebOb joins the redirect target to     the request URI using Python's urljoin, and since Python 3.10 the underlying urlsplit strips ASCII tab,     carriage return, and newline characters before parsing, so a redirect target containing such characters     can be reinterpreted as a protocol-relative URL whose authority is an attacker-controlled host. This     bypasses the CVE-2024-42353 fix that escaped a leading double slash, allowing an attacker who influences     the redirect location to send users to an arbitrary external site instead of the intended one. This     vulnerability is fixed in 1.8.10. (CVE-2026-44889)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP
    Location header during a redirect is vulnerable to an open redirect: WebOb joins the redirect target to
    the request URI using Python's urljoin, and since Python 3.10 the underlying urlsplit strips ASCII tab,
    carriage return, and newline characters before parsing, so a redirect target containing such characters
    can be reinterpreted as a protocol-relative URL whose authority is an attacker-controlled host. This
    bypasses the CVE-2024-42353 fix that escaped a leading double slash, allowing an attacker who influences
    the redirect location to send users to an arbitrary external site instead of the intended one. This
    vulnerability is fixed in 1.8.10. (CVE-2026-44889)

ID	Name	Product	Family	Severity
324920	Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2026-44889)	Nessus	Azure Linux Local Security Checks	medium
324864	SUSE SLES16: python-WebOb-doc / python313-Markdown / python313-PyGithub / etc (SUSE-SU-2026:22370-1)	Nessus	SuSE Local Security Checks	medium
324055	openSUSE 16: python313-Markdown / python313-PyGithub / python313-WebOb / etc (openSUSE-SU-2026:21063-1)	Nessus	SuSE Local Security Checks	medium
322297	Linux Distros Unpatched Vulnerability : CVE-2026-44889	Nessus	Misc.	medium
442641	SCA: security update for webob (GHSA-fh3h-vg37-cc95)	Tenable Cloud Security	SCA Checks	medium
442641	SCA: security update for webob (GHSA-fh3h-vg37-cc95)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-44889

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium