`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3245-1 advisory.

    - CVE-2026-7210: insufficient entropy used for Expat hash-flooding protection allows a crafted XML     document to trigger       hash flooding (bsc#1264962).
    - CVE-2026-8328: server-supplied PASV host address is trusted by `ftpcp()` and allows for SSRF     (bsc#1265268).
    - CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination     directory and       enables arbitrary file reads and writes (bsc#1268977).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1930 advisory.

    The tarfile module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while     processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a     crafted tar archive being misinterpreted by the tarfile module compared to other implementations.
    (CVE-2025-13462)

    tarfile.extractall() with the 'data' or 'tar'filter could be bypassed by a crafted archive where a     hardlinkreferences a symlink stored at a deeper name than the hardlink itself.The extraction fallback     validated the symlink at it's archived locationbut recreated it at the hardlink's shallowerpath, letting a     relativetarget the filter judged contained escape the destination directory.This allowed a malicious tar     archive to create a symlink pointingoutside the destination, enabling out-of-destination file reads     orwrites. This was an incomplete fix of CVE-2025-4330. (CVE-2026-11940)

    `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding     protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this     vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch. (CVE-2026-7210)

    The ftpcp() function in Lib/ftplib.py was not updated whenCVE-2021-4189 was fixed. While makepasv() was     patched to replaceserver-supplied PASV host addresses with the actual peer address(getpeername()[0]),     ftpcp() still calls parse227() directly and passesthe raw attacker-controllable IP address and port to     target.sendport(). This patch is related to CVE-2021-4189. (CVE-2026-8328)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1933 advisory.

    The tarfile module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while     processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a     crafted tar archive being misinterpreted by the tarfile module compared to other implementations.
    (CVE-2025-13462)

    When calling base64.b64decode() or related functions the decoding process would stop after encountering     the first padded quad regardless of whether there was more information to be processed. This can lead to     data being accepted which may be processed differently by other implementations. Use validate=True to     enable stricter processing of base64 data. (CVE-2026-3446)

    pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.
    (CVE-2026-3479)

    `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding     protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this     vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch. (CVE-2026-7210)

    The ftpcp() function in Lib/ftplib.py was not updated whenCVE-2021-4189 was fixed. While makepasv() was     patched to replaceserver-supplied PASV host addresses with the actual peer address(getpeername()[0]),     ftpcp() still calls parse227() directly and passesthe raw attacker-controllable IP address and port to     target.sendport(). This patch is related to CVE-2021-4189. (CVE-2026-8328)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1931 advisory.

    The tarfile module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while     processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a     crafted tar archive being misinterpreted by the tarfile module compared to other implementations.
    (CVE-2025-13462)

    tarfile.extractall() with the 'data' or 'tar'filter could be bypassed by a crafted archive where a     hardlinkreferences a symlink stored at a deeper name than the hardlink itself.The extraction fallback     validated the symlink at it's archived locationbut recreated it at the hardlink's shallowerpath, letting a     relativetarget the filter judged contained escape the destination directory.This allowed a malicious tar     archive to create a symlink pointingoutside the destination, enabling out-of-destination file reads     orwrites. This was an incomplete fix of CVE-2025-4330. (CVE-2026-11940)

    `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding     protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this     vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch. (CVE-2026-7210)

    The ftpcp() function in Lib/ftplib.py was not updated whenCVE-2021-4189 was fixed. While makepasv() was     patched to replaceserver-supplied PASV host addresses with the actual peer address(getpeername()[0]),     ftpcp() still calls parse227() directly and passesthe raw attacker-controllable IP address and port to     target.sendport(). This patch is related to CVE-2021-4189. (CVE-2026-8328)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1910 advisory.

    tarfile.extractall() with the 'data' or 'tar'filter could be bypassed by a crafted archive where a     hardlinkreferences a symlink stored at a deeper name than the hardlink itself.The extraction fallback     validated the symlink at it's archived locationbut recreated it at the hardlink's shallowerpath, letting a     relativetarget the filter judged contained escape the destination directory.This allowed a malicious tar     archive to create a symlink pointingoutside the destination, enabling out-of-destination file reads     orwrites. This was an incomplete fix of CVE-2025-4330. (CVE-2026-11940)

    CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. (CVE-2026-1502)

    unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input     containing long runs of combining characters with alternating Canonical Combining Class values. This     affects all normalization forms. (CVE-2026-3276)

    `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding     protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this     vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch. (CVE-2026-7210)

    tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process. (CVE-2026-7774)

    The ftpcp() function in Lib/ftplib.py was not updated whenCVE-2021-4189 was fixed. While makepasv() was     patched to replaceserver-supplied PASV host addresses with the actual peer address(getpeername()[0]),     ftpcp() still calls parse227() directly and passesthe raw attacker-controllable IP address and port to     target.sendport(). This patch is related to CVE-2021-4189. (CVE-2026-8328)

    bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data. (CVE-2026-9669)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8524-1 advisory.

    It was discovered that Python did not use sufficient entropy for Expat hash-flooding protection in the     xml.parsers.expat and xml.etree.ElementTree modules. An attacker could use this to cause a denial of     service via a crafted XML document.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-b17b2a984a advisory.

    New Python release including bugfixes and security fixes.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-a2c583a4ab advisory.

    New Python release including bugfixes and security fixes.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dfc9182263 advisory.

    New Python version including bugfixes and security fixes.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2deb979d80 advisory.

    New Python release including bugfixes and security fixes.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the python3 package has been released.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1774 advisory.

    The tarfile module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while     processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a     crafted tar archive being misinterpreted by the tarfile module compared to other implementations.
    (CVE-2025-13462)

    CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. (CVE-2026-1502)

    The profiling.sampling module (Python 3.15+) and asyncio introspection capabilities (3.14+, python -m     asyncio ps and python -m asyncio pstree) features could be used to read and write addresses in a     privileged process if that process connected to a malicious or infected Python process via the remote     debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be     exploited, even after the connecting process crashes with high likelihood due to ASLR. (CVE-2026-5713)

    http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes  for JavaScript     string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated     script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
    (CVE-2026-6019)

    `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding     protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this     vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch. (CVE-2026-7210)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding     protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this     vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch. (CVE-2026-7210)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
330283	SUSE SLES12: libpython3_4m1_0 / libpython3_4m1_0-32bit / python3 / python3-base / etc (SUSE-SU-2026:3245-1)	Nessus	SuSE Local Security Checks	high
327402	Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2026-1930)	Nessus	Amazon Linux Local Security Checks	high
327397	Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2026-1933)	Nessus	Amazon Linux Local Security Checks	medium
327389	Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2026-1931)	Nessus	Amazon Linux Local Security Checks	high
327378	Amazon Linux 2023 : python3.13, python3.13-devel, python3.13-freethreading (ALAS2023-2026-1910)	Nessus	Amazon Linux Local Security Checks	high
326307	Ubuntu 16.04 LTS : Python vulnerability (USN-8524-1)	Nessus	Ubuntu Local Security Checks	medium
323276	Fedora 43 : python3-docs / python3.14 (2026-b17b2a984a)	Nessus	Fedora Local Security Checks	medium
322120	Fedora 44 : python3-docs / python3.14 (2026-a2c583a4ab)	Nessus	Fedora Local Security Checks	medium
321848	Fedora 44 : python3.13 (2026-dfc9182263)	Nessus	Fedora Local Security Checks	critical
321844	Fedora 43 : python3.13 (2026-2deb979d80)	Nessus	Fedora Local Security Checks	critical
321579	Photon OS 5.0: Python3 PHSA-2026-5.0-0882	Nessus	PhotonOS Local Security Checks	high
319867	Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-1774)	Nessus	Amazon Linux Local Security Checks	medium
314657	Linux Distros Unpatched Vulnerability : CVE-2026-7210	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-7210

medium

Tenable Plugins

high

high

medium

high

high

medium

medium

medium

critical

critical

high

medium

medium