tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3649-1 advisory.

    - CVE-2025-15366: user-controlled command can allow additional commands injected using newlines     (bsc#1257044).
    - CVE-2025-15367: control characters may allow the injection of additional commands (bsc#1257041).
    - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when     the       `configparser` module is used (bsc#1269066).
    - CVE-2026-3219: python-pip: pip doesn't reject concatenated ZIP (bsc#1262429).
    - CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing     specially crafted       Unicode input (bsc#1267581).
    - CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when     extracting       hardlinks (bsc#1269959).
    - CVE-2026-6100: Arbitrary code execution or information disclosure via use-after-free in decompression     modules       (bsc#1262098).
    - CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-     flooding       protection (bsc#1264962).
    - CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction     directory       (bsc#1267821).
    - CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address     (bsc#1265268).
    - CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination     directory and       enables arbitrary file reads and writes (bsc#1268977).
    - CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead     to DoS       (bsc#1269788).
    - CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup     declarations       (bsc#1271192).
    - Regression in `http.cookies` (bsc#1263083).

    Changes for python313:

    - Update to 3.13.14:
     - Security
     - gh-151159: Bumps the OpenSSL version to 3.0.21 on Android.
     - gh-150599: Fix a possible stack buffer overflow in bz2 when      a bz2.BZ2Decompressor is reused after a decompression      error. The decompressor now becomes unusable after libbz2      reports an error.
     - gh-149835: shutil.move() now resolves symlinks via      os.path.realpath() when checking whether the destination is      inside the source directory, preventing a symlink-based      bypass of that guard.
     - gh-149698: Update bundled libexpat to version 2.8.1 for the      fix for CVE 2026-45186.
     - gh-87451: The ftplib module's undocumented ftpcp function      no longer trusts the IPv4 address value returned from the      source server in response to the PASV command by default,      completing the fix for CVE-2021-4189. As with ftplib.FTP,      the former behavior can be re-enabled by setting the      trust_server_pasv_ipv4_address attribute on the source      ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape      AI for the report (bsc#1265268, CVE-2026-8328)
     - gh-149486: tarfile.data_filter() now validates link targets      using the same normalised value that is written to disk,      strips trailing separators from the member name when      resolving a symlink's directory, and rejects link members      that would replace the destination directory itself. This      closes several path-traversal bypasses of the data      extraction filter (bsc#1267821, CVE-2026-7774).
     - gh-149079: Fix a potential denial of service in      unicodedata.normalize(). The canonical ordering step of      Unicode normalization used a quadratic-time insertion sort      for reordering combining characters, which could be      exploited with crafted input containing many combining      characters in non-canonical order. Replaced with      a linear-time counting sort for long runs (bsc#1267581,      CVE-2026-3276).
     - gh-149018: Improved protection against XML hash-flooding      attacks in xml.parsers.expat and xml.etree.ElementTree when      Python is compiled with libExpat 2.8.0 or later      (CVE-2026-7210, bsc#1264962).
     - gh-149017: Update bundled libexpat to version 2.8.0.
     - gh-90309: Base64-encode values when embedding cookies to      JavaScript using the http.cookies.BaseCookie.js_output()      method to avoid injection and escaping. (bsc#1262654,      CVE-2026-6019)
     - gh-148808: Added buffer boundary check when using nbytes      parameter with      asyncio.AbstractEventLoop.sock_recvfrom_into(). Only      relevant for Windows and the asyncio.ProactorEventLoop.
     - gh-148395: Fix a dangling input pointer in      lzma.LZMADecompressor, bz2.BZ2Decompressor, and internal      zlib._ZlibDecompressor when memory allocation fails with      MemoryError, which could let a subsequent decompress() call      read or write through a stale pointer to the      already-released caller buffer. (bsc#1262098,      CVE-2026-6100, seems like it has been incompletely applied      gh#python/cpython#151605)
     - gh-148169: A bypass in webbrowser allowed URLs prefixed      with %action to pass the dash-prefix safety check      (bsc#1262098, CVE-2026-6100).
     - gh-146581: Fix vulnerability in shutil.unpack_archive() for      ZIP files on Windows which allowed to write files outside      of the destination tree if the patch in the archive      contains a Windows drive prefix. Now such invalid paths      will be skipped. Files containing '..' in the name (like      'foo..bar') are no longer skipped.
     - gh-146333: Fix quadratic backtracking in      configparser.RawConfigParser option parsing regexes (OPTCRE      and OPTCRE_NV). A crafted configuration line with many      whitespace characters could cause excessive CPU usage.
     - gh-146211: Reject CR/LF characters in tunnel request      headers for the HTTPConnection.set_tunnel() method.
     (bsc#1261969, CVE-2026-1502)
     - gh-149144: Fixes an issue introduced by CVE-2026-6019      patch. atob() in JavaScript processes bytes as 'latin-1',      switches the encoding algorithm from base64 to percent      encoding and uses the decodeURIComponent() JavaScript API      (bsc#1263083).
     - Core and Builtins
     - gh-151112: Fix a crash in the compiler that could occur      when running out of memory.
     - gh-151126: Fix a crash, when there's no memory left on      a device, which happened in:
     - code compilation - _winapi.CreateProcess()
     - Now these places raise proper MemoryError errors.
     - gh-150633: Fix the frozen importer accepting module names      with embedded null bytes, which caused it to bypass the      sys.modules cache and create duplicate module objects.
     - gh-149156: Fix an intermittent crash after os.fork() when      perf trampoline profiling is enabled and the child returns      through trampoline frames inherited from the parent      process.
     - gh-149449: Fix a use-after-free crash when the unicodedata      module was removed from sys.modules and garbage-collected      between calls that decode \N{...} escapes or use the      namereplace codec error handler.
     - gh-148450: Fix abc.register() so it invalidates type      version tags for registered classes.
     - gh-150207: Fix a crash when a memory allocation fails      during tokenizer initialization. A proper MemoryError is      now raised instead.
     - gh-150107: asyncio: sendfile() and sock_sendfile() event      loop methods now call file.seek(offset) if file has      a seek() method, even if offset is 0 (default value).
     - gh-150146: Fix a crash on a complex type variable      substitution.
     - from typing import TypeVar;
     memoryview[TypeVar('')][*typing.Mapping[..., ...]] used to      fail due to missing NULL check on _unpack_args C function      call.
     - gh-149590: Fix crash when faulthandler is imported more      than once.
     - gh-149738: sqlite3: Disallow removing row_factory and      text_factory attributes of a connection to prevent a crash      on a query.
     - gh-139808: Add branch protections for AArch64 (BTI/PAC) in      assembly code used by -X perf_jit (Linux perf profiler      integration).
     - gh-148820: Fix a race in _PyRawMutex on the free-threaded      build where a Py_PARK_INTR return from _PySemaphore_Wait      could let the waiter destroy its semaphore before the      unlocking thread's _PySemaphore_Wakeup completed, causing      a fatal ReleaseSemaphore error.
     - gh-148653: Forbid marshalling recursive code objects which      cannot be correctly unmarshalled.
     - gh-148390: Fix an undefined behavior in memoryview when      using the native boolean format (?) in cast(). Previously,      on some common platforms, calling      memoryview(b).cast('?').tolist() incorrectly returned      [False] instead of [True] for any even byte b. Patch by      B?n?dikt Tran.
     - gh-148418: Fix a possible reference leak in a corrupted      TYPE_CODE marshal stream.
     - gh-148222: Fix vectorcall support in types.GenericAlias      when the underlying type does not support the vectorcall      protocol. Fix possible leaks in types.GenericAlias and      types.UnionType in case of memory error.
     - gh-145376: Fix reference leaks in various unusual error      scenarios.
     - C API
     - gh-150907: Fix dynamic_annotations.h header file when built      with C++ and Valgrind: add extern 'C++' scope for the C++      template. Patch by Victor Stinner.
     - Build
     - gh-149351: Avoid possible broken macOS framework install      names when DESTDIR is specified during builds.
     - gh-146475: Block Apple Clang from being used to build the      JIT as it ships without required LLVM tools.
     - gh-148535: No longer use the gcc -fprofile-update=atomic      flag on i686. The flag has been added to fix a random GCC      internal error on PGO build (gh-145801) caused by      corruption of profile data (.gcda files). The problem is      that it makes the PGO build way slower (up to 47x slower)      on i686. Since the GCC internal error was not seen on i686      so far, don't use -fprofile-update=atomic on i686 anymore.
     Patch by Victor Stinner.
     - Library
     - gh-150913: Fix sqlite3.Blob slice assignment to raise      TypeError and IndexError for type and size mismatches      respectively, even when the target slice is empty.
     - gh-143008: Fix race conditions when re-initializing      a io.TextIOWrapper object.
     - gh-150685: Update bundled pip to 26.1.2
     - gh-150406: Fix a possible crash occurring during socket      module initialization when the system is out of memory on      platforms without a reentrant gethostbyname.
     - gh-150372: readline: Fix a potential crash during tab      completion caused by an out-of-memory error during module      initialization.
     - gh-150175: Fix race condition in      unittest.mock.ThreadingMock where concurrent calls could      lose increments to call_count and other attributes due to      a missing lock in _increment_mock_call.
     - gh-84353: Preserve non-UTF-8 encoded filenames when      appending to a zipfile.ZipFile. Previously, non-ASCII names      stored in a legacy encoding (without the UTF-8 flag bit      set) could be corrupted when the central directory was      rewritten: they were decoded as cp437 and then re-stored as      UTF-8.
     - gh-149995: Update various docstrings in typing.
     - gh-88726: The email package now uses standard MIME charset      names 'gb2312' and 'big5' instead of non-standard names      'eucgb2312_cn' and 'big5_tw'.
     - gh-149571: Fix the C implementation of      xml.etree.ElementTree.Element.itertext(): it no longer      emits text for comments and processing instructions.
     - gh-149921: Fix reference leaks in error paths of the
     _interpchannels and _interpqueues extension modules.
     - gh-149801: Add IANA registered names and aliases with      leading zeros before number (like IBM00858, CP00858,      IBM01140, CP01140) for corresponding codecs.
     - gh-149701: Fix bad return code from Lib/venv/bin/activate      if hashing is disabled
     - gh-112821: In the REPL, autocompletion might run arbitrary      code in the getter of a descriptor. If that getter raised      an exception, autocompletion would fail to present any      options for the entire object. Autocompletion now works as      expected for these objects.
     - gh-149388: Make asyncio.windows_utils.PipeHandle closing      idempotent.
     - gh-149489: Fix ElementTree serialization to HTML. The      content of elements 'xmp', 'iframe', 'noembed', 'noframes',      and 'plaintext' is no longer escaped. The 'plaintext'      element no longer have the closing tag.
     - gh-149377: Update bundled pip to 26.1.1
     - gh-149231: In tomllib, the number of parts in TOML keys is      now limited.
     - gh-149117: Fix runpy.run_module() and runpy.run_path() to      set the name attribute on the ImportError they raise.
     - gh-149148: ensurepip: Upgrade bundled pip to 26.1. This      version fixes the CVE 2026-3219 vulnerability. Patch by      Victor Stinner.
     - gh-148093: Fix an out-of-bounds read of one byte in      binascii.a2b_uu(). Raise binascii.Error, instead of reading      past the buffer end.
     - gh-148914: Fix memoization of in-band PickleBuffer in the      Python implementation of pickle. Previously, identical      PickleBuffers did not preserve identity, and empty writable      PickleBuffer memoized an empty bytearray object in place of      b'', so the following references to b'' were unpickled as      an empty bytearray object.
     - gh-138907: Support RFC 9309 in urllib.robotparser.
     - gh-148954: Fix XML injection vulnerability in      xmlrpc.client.dumps() where the methodname was not being      escaped before interpolation into the XML body.
     - gh-148801: xml.etree.ElementTree: Fix a crash in      Element.__deepcopy__ on deeply nested trees.
     - gh-148735: xml.etree.ElementTree: Fix a use-after-free in      Element.findtext when the element tree is mutated      concurrently during the search.
     - gh-146553: Fix infinite loop in typing.get_type_hints()      when __wrapped__ forms a cycle. Patch by Shamil Abdulaev.
     - gh-148508: An intermittent timing error when running SSL      tests on iOS has been resolved.
     - gh-148518: If an email containing an address header that      ended in an open double quote was parsed with      a non-compat32 policy, accessing the username attribute of      the mailbox accessed through that header object would      result in an IndexError. It now correctly returns an empty      string as the result.
     - gh-148370: configparser: prevent quadratic behavior when      a ParsingError is raised after a parser fails to parse      multiple lines. Patch by B?n?dikt Tran.
     - gh-148254: Use singular 'sec' instead of 'secs' in timeit      verbose output for consistency with other time units.
     - gh-148192: email.generator.Generator._make_boundary could      fail to detect a duplicate boundary string if linesep was      not n. It now correctly detects boundary strings when      linesep is rn as well.
     - gh-146313: Fix a deadlock in multiprocessing's resource      tracker where the parent process could hang indefinitely in      os.waitpid() during interpreter shutdown if a child created      via os.fork() still held the resource tracker's pipe open.
     - gh-145831: Fix email.quoprimime.decode() leaving a stray \r      when eol='\r\n' by stripping the full eol string instead of      one character.
     - gh-145105: Fix crash in csv reader when iterating with      a re-entrant iterator that calls next() on the same reader      from within __next__.
     - gh-130750: Restore quoting of choices in argparse error      messages for improved clarity and consistency with      documentation.
     - gh-105936: Attempting to mutate non-field attributes of      dataclasses with both frozen and slots being True now      raises FrozenInstanceError instead of TypeError. Their      non-dataclass subclasses can now freely mutate non-field      attributes, and the original non-slotted class can be      garbage collected. The fix also handles the case of an      empty __class__ cell on a function found within the class      (gh-148947).
     - gh-142516: ssl: fix reference leaks in ssl.SSLContext      objects. Patch by B?n?dikt Tran.
     - gh-142831: Fix a crash in the json module where      a use-after-free could occur if the object being encoded is      modified during serialization.
     - gh-140287: The asyncio REPL now handles exceptions when      executing PYTHONSTARTUP scripts. Patch by Bartosz Sawecki.
     - gh-90949: Add      SetBillionLaughsAttackProtectionActivationThreshold() and      SetBillionLaughsAttackProtectionMaximumAmplification() to      xmlparser objects to tune protections against billion      laughs attacks. Patch by B?n?dikt Tran.
     - gh-132631: Fix 'I/O operation on closed file' when parsing      JSON Lines file with JSON CLI.
     - gh-128110: Fix bug in the parsing of email address headers      that could result in extraneous spaces in the decoded text      when using a modern email policy. Space between pairs of      adjacent RFC 2047 encoded-words is now ignored, per section      6.2 (and consistent with existing parsing of unstructured      headers like Subject).
     - gh-107398: Fix tarfile stream mode exception when process      the file with the gzip extra field.
     - gh-123853: Update the table of Windows language code      identifiers (LCIDs) used by locale.getdefaultlocale() on      Windows to protocol version 16.0 (2024-04-23).
     - gh-70039: Fixed bug where smtplib.SMTP.starttls() could      fail if smtplib.SMTP.connect() is called explicitly rather      than implicitly.
     - gh-83281: email: improve handling trailing garbage in      address lists to avoid throwing AttributeError in certain      edge cases
     - gh-91099: imaplib.IMAP4.login() now raises exceptions with      str instead of bytes. Patch by Florian Best.
     - IDLE
     - bpo-6699: Warn the user if a file will be overwritten when      saving.
     - Documentation
     - gh-150319: Generic builtin and standard library types now      document the meaning of their type parameters.
     - gh-148663: Document that calendar.IllegalMonthError is      a subclass of both ValueError and IndexError since Python      3.12.
     - gh-146646: Document that glob.glob(), glob.iglob(),      pathlib.Path.glob(), and pathlib.Path.rglob() silently      suppress OSError exceptions raised from scanning the      filesystem.
     - gh-109503: Fix documentation for shutil.move() on usage of      os.rename() since nonatomic move might be used even if the      files are on the same filesystem. Patch by Fang Li
     - Tests
     - gh-151130: Add more tests for PyWeakref_* C API.
     - gh-149776: Fix test_socket on Linux kernel 7.1 and newer:
     skip UDP Lite tests if it's not supported. Patch by Victor      Stinner.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3601-1 advisory.

    - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when     the       `configparser` module is used (bsc#1269066).
    - CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting     maliciously       crafted wheel archives (bsc#1257599).
    - CVE-2026-3219: python-pip: pip doesn't reject concatenated ZIP (bsc#1262467).
    - CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing     specially crafted       Unicode input (bsc#1267581).
    - CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when     extracting       hardlinks (bsc#1269959).
    - CVE-2026-6357: pip self-update functionality can import newly installed modules after wheel installation     (bsc#1263442,       bsc#1263443).
    - CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction     directory       (bsc#1267821).
    - CVE-2026-8643: Path traversal via malicious entry point name in pip wheel installation allows arbitrary     file overwrite       (bsc#1266669).
    - CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead     to DoS       (bsc#1269788).
    - CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup     declarations       (bsc#1271192).
    - Fix for CVE-2026-6019 does not handle non-ascii chars correctly. Regression in `http.cookies`     (bsc#1263083).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3569-1 advisory.

    Security issues fixed:

    - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when     the       `configparser` module is used (bsc#1269066).
    - CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing     specially crafted       Unicode input (bsc#1267581).
    - CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when     extracting       hardlinks (bsc#1269959).
    - CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-     flooding       protection (bsc#1264962).
    - CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction     directory       (bsc#1267821).
    - CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address     (bsc#1265268).
    - CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination     directory and       enables arbitrary file reads and writes (bsc#1268977).
    - CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead     to DoS       (bsc#1269788).
    - CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup     declarations       (bsc#1271192).

    Non security issues fixed:

    - [kernel 7.1] udplite was removed -> python fails in tests (bsc#1268375).
    - crypto-policies: Extend the crypto-policies support for mozilla-nss, openjdk, krb5, bind, stunnel,     openssh, libssh and       more packages (bsc#1211301).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3548-1 advisory.

    Security issues fixed:

    - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when     the       `configparser` module is used (bsc#1269066).
    - CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing     specially crafted       Unicode input (bsc#1267581).
    - CVE-2026-4360: in the `Tarfile.extract()` function, the filter parameter is not passed properly when     extracting       hardlinks (bsc#1269959).
    - CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-     flooding       protection (bsc#1264962).
    - CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction     directory       (bsc#1267821).
    - CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address     (bsc#1265268).
    - CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination     directory and       enables arbitrary file reads and writes (bsc#1268977).
    - CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead     to DoS       (bsc#1269788).
    - CVE-2026-15308: incremental `HTMLParser` allows CPU-exhaustion DoS via repeated unterminated markup     declarations       (bsc#1271192).

    Non security issue fixed:

    - Improve testing for the support of `IPPROTO_UDPLITE`, which could be not present although header files     are       (bsc#1268375).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3560-1 advisory.

    Security issues fixed:

    - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when     the       `configparser` module is used (bsc#1269066).
    - CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing     specially crafted       Unicode input (bsc#1267581).
    - CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when     extracting       hardlinks (bsc#1269959).
    - CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-     flooding       protection (bsc#1264962).
    - CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction     directory       (bsc#1267821).
    - CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address     (bsc#1265268).
    - CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination     directory and       enables arbitrary file reads and writes (bsc#1268977).
    - CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead     to DoS       (bsc#1269788).
    - CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup     declarations       (bsc#1271192).

    Non security issue fixed:

    - [kernel 7.1] udplite was removed -> python fails in tests (bsc#1268375).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3530-1 advisory.

    Security issues fixed:

    - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when     the       `configparser` module is used (bsc#1269066).
    - CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing     specially crafted       Unicode input (bsc#1267581).
    - CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when     extracting       hardlinks (bsc#1269959).
    - CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-     flooding       protection (bsc#1264962).
    - CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction     directory       (bsc#1267821).
    - CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address     (bsc#1265268).
    - CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination     directory and       enables arbitrary file reads and writes (bsc#1268977).
    - CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead     to DoS       (bsc#1269788).
    - CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup     declarations       (bsc#1271192).

    Non security issues fixed:

    - [kernel 7.1] udplite was removed -> python fails in tests (bsc#1268375).
    - crypto-policies: Extend the crypto-policies support for mozilla-nss, openjdk, krb5, bind, stunnel,     openssh, libssh and       more packages (bsc#1211301).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1995 advisory.

    The incremental HTML parser (html.parser.HTMLParser) allows for CPUdenial-of-service through repeated     unterminated markup declarations whenprocessing uncontrolled data. (CVE-2026-15308)

    In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks.
    An affected system that extracts content from untrusted tar files could end up writing files with an     unexpected uid/gid despite the user passing filter='data' to the extract() function. (CVE-2026-4360)

    tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process. (CVE-2026-7774)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1954 advisory.

    When using the configparser module to write configuration filescontaining multi-line text values with     carriage return characters (\r) theresulting file could be injected with unexpected keys and values if     theattacker controls the written value. (CVE-2026-0864)

    When using the tarfile module with a file opened in streaming mode (mode=r|) the tarfile module did     not properly handle EOF, making archive parsing take exponentially longer. (CVE-2026-11972)

    CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. (CVE-2026-1502)

    unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input     containing long runs of combining characters with alternating Canonical Combining Class values. This     affects all normalization forms. (CVE-2026-3276)

    tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process. (CVE-2026-7774)

    bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data. (CVE-2026-9669)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1953 advisory.

    When using the configparser module to write configuration filescontaining multi-line text values with     carriage return characters (\r) theresulting file could be injected with unexpected keys and values if     theattacker controls the written value. (CVE-2026-0864)

    When using the tarfile module with a file opened in streaming mode (mode=r|) the tarfile module did     not properly handle EOF, making archive parsing take exponentially longer. (CVE-2026-11972)

    unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input     containing long runs of combining characters with alternating Canonical Combining Class values. This     affects all normalization forms. (CVE-2026-3276)

    tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process. (CVE-2026-7774)

    bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data. (CVE-2026-9669)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1910 advisory.

    tarfile.extractall() with the 'data' or 'tar'filter could be bypassed by a crafted archive where a     hardlinkreferences a symlink stored at a deeper name than the hardlink itself.The extraction fallback     validated the symlink at it's archived locationbut recreated it at the hardlink's shallowerpath, letting a     relativetarget the filter judged contained escape the destination directory.This allowed a malicious tar     archive to create a symlink pointingoutside the destination, enabling out-of-destination file reads     orwrites. This was an incomplete fix of CVE-2025-4330. (CVE-2026-11940)

    CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. (CVE-2026-1502)

    unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input     containing long runs of combining characters with alternating Canonical Combining Class values. This     affects all normalization forms. (CVE-2026-3276)

    `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding     protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this     vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch. (CVE-2026-7210)

    tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process. (CVE-2026-7774)

    The ftpcp() function in Lib/ftplib.py was not updated whenCVE-2021-4189 was fixed. While makepasv() was     patched to replaceserver-supplied PASV host addresses with the actual peer address(getpeername()[0]),     ftpcp() still calls parse227() directly and passesthe raw attacker-controllable IP address and port to     target.sendport(). This patch is related to CVE-2021-4189. (CVE-2026-8328)

    bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data. (CVE-2026-9669)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1929 advisory.

    tarfile.extractall() with the 'data' or 'tar'filter could be bypassed by a crafted archive where a     hardlinkreferences a symlink stored at a deeper name than the hardlink itself.The extraction fallback     validated the symlink at it's archived locationbut recreated it at the hardlink's shallowerpath, letting a     relativetarget the filter judged contained escape the destination directory.This allowed a malicious tar     archive to create a symlink pointingoutside the destination, enabling out-of-destination file reads     orwrites. This was an incomplete fix of CVE-2025-4330. (CVE-2026-11940)

    unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input     containing long runs of combining characters with alternating Canonical Combining Class values. This     affects all normalization forms. (CVE-2026-3276)

    tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process. (CVE-2026-7774)

    The ftpcp() function in Lib/ftplib.py was not updated whenCVE-2021-4189 was fixed. While makepasv() was     patched to replaceserver-supplied PASV host addresses with the actual peer address(getpeername()[0]),     ftpcp() still calls parse227() directly and passesthe raw attacker-controllable IP address and port to     target.sendport(). This patch is related to CVE-2021-4189. (CVE-2026-8328)

    bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data. (CVE-2026-9669)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8509-1 advisory.

    It was discovered that Python incorrectly normalized paths in the tarfile module. An attacker could     possibly use this issue to bypass path restrictions. This issue only affected Ubuntu 22.04 LTS and Ubuntu     24.04 LTS. (CVE-2025-13462)

    It was discovered that Python's HTMLParser incorrectly handled certain malformed HTML input. An attacker     could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only     affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-69534)

    It was discovered that Python's email module incorrectly quoted newlines in headers. An attacker could     possibly use this issue to inject arbitrary email headers. This issue only affected Ubuntu 22.04 LTS and     Ubuntu 24.04 LTS. (CVE-2026-1299)

    It was discovered that Python's http.client module did not properly sanitize carriage return and linefeed     characters when handling HTTP CONNECT tunnel request headers. An attacker could possibly use this issue to     inject arbitrary HTTP headers. (CVE-2026-1502)

    It was discovered that Python's importlib module did not generate an audit event when loading legacy .pyc     files. An attacker could possibly use this issue to bypass auditing mechanisms. This issue only affected     Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-2297)

    It was discovered that Python's unicodedata.normalize() function had incorrect algorithmic complexity. An     attacker could possibly use this issue to cause Python to consume excessive resources, leading to a denial     of service. (CVE-2026-3276)

    It was discovered that Python's http.cookies module incorrectly handled control characters in certain     cookie operations. An attacker could possibly use this issue to inject arbitrary content. This issue only     affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-3644)

    It was discovered that the Python pyexpat module was vulnerable to unbounded recursion in the Expat XML     parser. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of     service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4224)

    It was discovered that Python's webbrowser module accepted leading dashes in URLs, which could be     interpreted as command-line options. An attacker could possibly use this issue to execute arbitrary     commands. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4519)

    It was discovered that Python incorrectly handled webbrowser.open() handlers. An attacker could possibly     use this issue to execute arbitrary commands. (CVE-2026-4786)

    It was discovered that Python's remote debugging module did not properly validate offset tables when     loading debug information. An attacker could possibly use this issue to cause Python to crash or execute     arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-5713)

    It was discovered that Python's http.cookies module incorrectly escaped values in the js_output() method.
    An attacker could possibly use this issue to inject arbitrary JavaScript. (CVE-2026-6019)

    It was discovered that Python's lzma, bz2, and gzip decompressor objects had a use-after-free     vulnerability. An attacker could possibly use this issue to cause Python to crash or execute arbitrary     code. (CVE-2026-6100)

    It was discovered that Python's tarfile module did not properly validate link targets when using the data     filter. An attacker could possibly use this issue to bypass path restrictions. This issue only affected     Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-7774)

    It was discovered that the fix for CVE-2021-4189 in Python's ftplib module was incomplete, allowing PASV     responses to be used in ftplib.ftpcp(). An attacker could possibly use this issue to perform server-side     request forgery attacks. (CVE-2026-8328)

    It was discovered that Python's bz2 module allowed reuse of a BZ2Decompressor object after a decompression     error. An attacker could possibly use this issue to cause Python to crash or execute arbitrary code.
    (CVE-2026-9669)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Python installed on the remote Windows host is affected by a path traversal vulnerability.
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process. (CVE-2026-7774)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
338626	SUSE SLED15: libpython3_13-1_0 / python313 / python313-base / python313-curses / etc (SUSE-SU-2026:3649-1)	Nessus	SuSE Local Security Checks	Local	high
335093	SUSE SLES12: libpython3_4m1_0 / libpython3_4m1_0-32bit / python3 / python3-base / etc (SUSE-SU-2026:3601-1)	Nessus	SuSE Local Security Checks	Local	high
335071	SUSE SLES15: libpython3_12-1_0 / python312 / python312-base / python312-curses / etc (SUSE-SU-2026:3569-1)	Nessus	SuSE Local Security Checks	Local	high
334781	SUSE SLES15: libpython3_11-1_0 / python311 / python311-base / python311-curses / etc (SUSE-SU-2026:3548-1)	Nessus	SuSE Local Security Checks	Local	high
334701	SUSE SLED15: libpython3_11-1_0 / python311 / python311-base / python311-curses / etc (SUSE-SU-2026:3560-1)	Nessus	SuSE Local Security Checks	Local	high
333543	SUSE SLES15: libpython3_10-1_0 / python310 / python310-base / python310-curses / etc (SUSE-SU-2026:3530-1)	Nessus	SuSE Local Security Checks	Local	high
331998	Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2026-1995)	Nessus	Amazon Linux Local Security Checks	Local	high
328487	Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2026-1954)	Nessus	Amazon Linux Local Security Checks	Local	high
328461	Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2026-1953)	Nessus	Amazon Linux Local Security Checks	Local	high
327378	Amazon Linux 2023 : python3.13, python3.13-devel, python3.13-freethreading (ALAS2023-2026-1910)	Nessus	Amazon Linux Local Security Checks	Local	high
327372	Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-1929)	Nessus	Amazon Linux Local Security Checks	Local	high
325428	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Python vulnerabilities (USN-8509-1)	Nessus	Ubuntu Local Security Checks	Local	critical
320851	Python 3.10.x / 3.11.x / 3.12.x / 3.13.x < 3.13.14 / 3.14.x < 3.14.6 Path Traversal	Nessus	Windows	Local	medium
318726	Linux Distros Unpatched Vulnerability : CVE-2026-7774	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-7774

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

critical

medium

medium