In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-6261b26f4e advisory.

    New version of the Python interpreter

    - Security fix for CVE-2026-19553
    - Security fix for CVE-2026-82049
    - Security fix for CVE-2026-15310
    - Security fix for CVE-2026-19672
    - Security fix for CVE-2026-19445
    - Security fix for CVE-2026-17084
    - Security fix for CVE-2026-15806



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to
    crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify
    the permissions or modification time of a file outside the destination directory, or expose the contents
    of that file within the extracted tree. (CVE-2026-82049)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1789719876 advisory.

  - In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to     crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify     the permissions or modification time of a file outside the destination directory, or expose the contents     of that file within the extracted tree. (CVE-2026-82049)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789749056 advisory.

  - In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to     crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify     the permissions or modification time of a file outside the destination directory, or expose the contents     of that file within the extracted tree. (CVE-2026-82049)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789749056 advisory.

  - In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to     crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify     the permissions or modification time of a file outside the destination directory, or expose the contents     of that file within the extracted tree. (CVE-2026-82049)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1789719542 advisory.

  - In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to     crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify     the permissions or modification time of a file outside the destination directory, or expose the contents     of that file within the extracted tree. (CVE-2026-82049)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1790238098 advisory.

  - The HTTPPasswordMgr class in the urllib.request module, along with its subclasses     HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account     when matching stored credentials against a requested URL. Credentials added for an https:// URL were also     used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to     plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials     in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching     is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for     requests with the same scheme. Credentials registered with a bare authority (such as example.com or     example.com:8080) continue to match any scheme, preserving compatibility with existing code, including     proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications     never make plain http:// requests to hosts for which credentials are registered, for example by not     following redirects to http:// URLs. (CVE-2026-15806)

  - unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input     containing long runs of combining characters with alternating Canonical Combining Class values. This     affects all normalization forms. (CVE-2026-3276)

  - tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process. (CVE-2026-7774)

  - In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to     crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify     the permissions or modification time of a file outside the destination directory, or expose the contents     of that file within the extracted tree. (CVE-2026-82049)

  - The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was     patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]),     ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to     target.sendport(). This patch is related to CVE-2021-4189. (CVE-2026-8328)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1789736914 advisory.

  - When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an     attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion. (CVE-2026-15310)

  - The stringprep module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest     Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause     mismatches when processing domain names using IDNA 2003 (the idna codec) and the in_table_b2() function     of the stringprep module. This only affects domain names containing characters that were not previously     registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.
    (CVE-2026-17084)

  - In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to     crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify     the permissions or modification time of a file outside the destination directory, or expose the contents     of that file within the extracted tree. (CVE-2026-82049)

  - When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member     from the archive. In this case, the filter function is run twice: once for the extracted member, and once     with name set to the location of the link. For one of the calls, the return value was ignored. Instead,     the member should be skipped if either call returns None. (CVE-2026-87910)

  - bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data. (CVE-2026-9669)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789662396 advisory.

  - In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to     crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify     the permissions or modification time of a file outside the destination directory, or expose the contents     of that file within the extracted tree. (CVE-2026-82049)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to     crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify     the permissions or modification time of a file outside the destination directory, or expose the contents     of that file within the extracted tree. (CVE-2026-82049)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
363793	Fedora 44 : python3-docs / python3.14 (2026-6261b26f4e)	Nessus	Fedora Local Security Checks	Local	critical
462623	Echo: python3.13: security update to 3.13.5-2+e37	Tenable Cloud Security	Echo Local Security Checks	Local	high
462623	Echo: python3.13: security update to 3.13.5-2+e37	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
361927	CentOS Linux 8.5 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc (CENTOS8.5:CLSA-2026:1789719876)	Nessus	CentOS Local Security Checks	Local	high
360872	AlmaLinux 9.6 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.6:CLSA-2026:1789749056)	Nessus	Alma Linux Local Security Checks	Local	high
360820	Rocky Linux 9.6 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.6:CLSA-2026:1789749056)	Nessus	Rocky Linux Local Security Checks	Local	high
359932	CentOS Linux 8 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc (CENTOS-STREAM8:CLSA-2026:1789719542)	Nessus	CentOS Local Security Checks	Local	high
359892	AlmaLinux 9.2 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1790238098)	Nessus	Alma Linux Local Security Checks	Local	high
352689	CentOS Linux 8.4 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1789736914)	Nessus	CentOS Local Security Checks	Local	high
351529	AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.2:CLSA-2026:1789662396)	Nessus	Alma Linux Local Security Checks	Local	high
345878	Linux Distros Unpatched Vulnerability : CVE-2026-82049	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-82049

high

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

high