The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8744-1 advisory.

    It was discovered that Python's http.cookies module incorrectly handled control characters in certain     cookie operations. An attacker could possibly use this issue to inject arbitrary content. This issue only     affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and     Ubuntu 24.04 LTS. (CVE-2026-3644)

    It was discovered that the Python pyexpat module was vulnerable to unbounded recursion in the Expat XML     parser. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of     service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,     Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4224)

    It was discovered that Python's tarfile module did not correctly apply the filter parameter when     extracting hard links. An attacker could possibly use this issue to cause files to be extracted with an     unexpected uid or gid, bypassing the restrictions requested via filter='data'. (CVE-2026-4360)

    It was discovered that Python's http.cookies module incorrectly escaped values in the js_output() method.
    An attacker could possibly use this issue to inject arbitrary JavaScript. (CVE-2026-6019)

    It was discovered that Python's html.parser module incorrectly handled repeated unterminated markup     declarations. An attacker could possibly use this issue to cause Python to consume excessive CPU     resources, leading to a denial of service. (CVE-2026-15308)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : Python vulnerabilities (USN-8744-1)

high Nessus Plugin ID 344659

Version 1.2

Version 1.1

Version 1.2 Sep 11, 2026, 4:27 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609111627
Version 1.1 Sep 11, 2026, 11:01 AM New Plugin Feed: 202609111101