It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1929 advisory.

    tarfile.extractall() with the 'data' or 'tar'filter could be bypassed by a crafted archive where a     hardlinkreferences a symlink stored at a deeper name than the hardlink itself.The extraction fallback     validated the symlink at it's archived locationbut recreated it at the hardlink's shallowerpath, letting a     relativetarget the filter judged contained escape the destination directory.This allowed a malicious tar     archive to create a symlink pointingoutside the destination, enabling out-of-destination file reads     orwrites. This was an incomplete fix of CVE-2025-4330. (CVE-2026-11940)

    unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input     containing long runs of combining characters with alternating Canonical Combining Class values. This     affects all normalization forms. (CVE-2026-3276)

    tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process. (CVE-2026-7774)

    The ftpcp() function in Lib/ftplib.py was not updated whenCVE-2021-4189 was fixed. While makepasv() was     patched to replaceserver-supplied PASV host addresses with the actual peer address(getpeername()[0]),     ftpcp() still calls parse227() directly and passesthe raw attacker-controllable IP address and port to     target.sendport(). This patch is related to CVE-2021-4189. (CVE-2026-8328)

    bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data. (CVE-2026-9669)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-1929)

high Nessus Plugin ID 327372

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.4 Jul 28, 2026, 1:30 PM CVE (set "CVE" coverage to "CVE-2026-3276,CVE-2026-7774,CVE-2026-8328,CVE-2026-9669,CVE-2026-11940") CVSS metrics ("Cvssv4 score" set to 8.2) CVSS metrics ("Cvssv4 vector" set to "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N") Plugin metadata Plugin Feed: 202607281330
Version 1.3 Jul 25, 2026, 1:06 PM CVE (set "CVE" coverage to "CVE-2026-3276,CVE-2026-7774,CVE-2026-8328,CVE-2026-11940") CVSS metrics ("Cvssv4 score" set to 7.8) CVSS metrics ("Cvssv4 vector" set to "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N") Plugin metadata Plugin Feed: 202607251306
Version 1.2 Jul 21, 2026, 8:31 PM CVE (set "CVE" coverage to "CVE-2026-3276,CVE-2026-7774,CVE-2026-8328,CVE-2026-9669,CVE-2026-11940") CVSS metrics ("Cvssv4 score" set to 8.2) CVSS metrics ("Cvssv4 vector" set to "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N") Plugin metadata Plugin Feed: 202607212031
Version 1.1 Jul 16, 2026, 9:04 PM New Plugin Feed: 202607162104