It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1910 advisory.

    tarfile.extractall() with the 'data' or 'tar'filter could be bypassed by a crafted archive where a     hardlinkreferences a symlink stored at a deeper name than the hardlink itself.The extraction fallback     validated the symlink at it's archived locationbut recreated it at the hardlink's shallowerpath, letting a     relativetarget the filter judged contained escape the destination directory.This allowed a malicious tar     archive to create a symlink pointingoutside the destination, enabling out-of-destination file reads     orwrites. This was an incomplete fix of CVE-2025-4330. (CVE-2026-11940)

    CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. (CVE-2026-1502)

    unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input     containing long runs of combining characters with alternating Canonical Combining Class values. This     affects all normalization forms. (CVE-2026-3276)

    `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding     protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this     vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch. (CVE-2026-7210)

    tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process. (CVE-2026-7774)

    The ftpcp() function in Lib/ftplib.py was not updated whenCVE-2021-4189 was fixed. While makepasv() was     patched to replaceserver-supplied PASV host addresses with the actual peer address(getpeername()[0]),     ftpcp() still calls parse227() directly and passesthe raw attacker-controllable IP address and port to     target.sendport(). This patch is related to CVE-2021-4189. (CVE-2026-8328)

    bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data. (CVE-2026-9669)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1953 advisory.

    When using the configparser module to write configuration filescontaining multi-line text values with     carriage return characters (\r) theresulting file could be injected with unexpected keys and values if     theattacker controls the written value. (CVE-2026-0864)

    When using the tarfile module with a file opened in streaming mode (mode=r|) the tarfile module did     not properly handle EOF, making archive parsing take exponentially longer. (CVE-2026-11972)

    unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input     containing long runs of combining characters with alternating Canonical Combining Class values. This     affects all normalization forms. (CVE-2026-3276)

    tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process. (CVE-2026-7774)

    bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data. (CVE-2026-9669)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8509-1 advisory.

    It was discovered that Python incorrectly normalized paths in the tarfile module. An attacker could     possibly use this issue to bypass path restrictions. This issue only affected Ubuntu 22.04 LTS and Ubuntu     24.04 LTS. (CVE-2025-13462)

    It was discovered that Python's HTMLParser incorrectly handled certain malformed HTML input. An attacker     could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only     affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-69534)

    It was discovered that Python's email module incorrectly quoted newlines in headers. An attacker could     possibly use this issue to inject arbitrary email headers. This issue only affected Ubuntu 22.04 LTS and     Ubuntu 24.04 LTS. (CVE-2026-1299)

    It was discovered that Python's http.client module did not properly sanitize carriage return and linefeed     characters when handling HTTP CONNECT tunnel request headers. An attacker could possibly use this issue to     inject arbitrary HTTP headers. (CVE-2026-1502)

    It was discovered that Python's importlib module did not generate an audit event when loading legacy .pyc     files. An attacker could possibly use this issue to bypass auditing mechanisms. This issue only affected     Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-2297)

    It was discovered that Python's unicodedata.normalize() function had incorrect algorithmic complexity. An     attacker could possibly use this issue to cause Python to consume excessive resources, leading to a denial     of service. (CVE-2026-3276)

    It was discovered that Python's http.cookies module incorrectly handled control characters in certain     cookie operations. An attacker could possibly use this issue to inject arbitrary content. This issue only     affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-3644)

    It was discovered that the Python pyexpat module was vulnerable to unbounded recursion in the Expat XML     parser. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of     service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4224)

    It was discovered that Python's webbrowser module accepted leading dashes in URLs, which could be     interpreted as command-line options. An attacker could possibly use this issue to execute arbitrary     commands. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4519)

    It was discovered that Python incorrectly handled webbrowser.open() handlers. An attacker could possibly     use this issue to execute arbitrary commands. (CVE-2026-4786)

    It was discovered that Python's remote debugging module did not properly validate offset tables when     loading debug information. An attacker could possibly use this issue to cause Python to crash or execute     arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-5713)

    It was discovered that Python's http.cookies module incorrectly escaped values in the js_output() method.
    An attacker could possibly use this issue to inject arbitrary JavaScript. (CVE-2026-6019)

    It was discovered that Python's lzma, bz2, and gzip decompressor objects had a use-after-free     vulnerability. An attacker could possibly use this issue to cause Python to crash or execute arbitrary     code. (CVE-2026-6100)

    It was discovered that Python's tarfile module did not properly validate link targets when using the data     filter. An attacker could possibly use this issue to bypass path restrictions. This issue only affected     Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-7774)

    It was discovered that the fix for CVE-2021-4189 in Python's ftplib module was incomplete, allowing PASV     responses to be used in ftplib.ftpcp(). An attacker could possibly use this issue to perform server-side     request forgery attacks. (CVE-2026-8328)

    It was discovered that Python's bz2 module allowed reuse of a BZ2Decompressor object after a decompression     error. An attacker could possibly use this issue to cause Python to crash or execute arbitrary code.
    (CVE-2026-9669)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data. (CVE-2026-9669)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding     protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this     vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.(CVE-2026-7210)

    tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process.(CVE-2026-7774)

    tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a     hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback     validated the symlink at its archived location but recreated it at the hardlink's shallower path, letting     a relative target the filter judged contained escape the destination directory. This allowed a malicious     tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads     or writes. This was an incomplete fix of CVE-2025-4330.(CVE-2026-11940)

    When an Expat parser with a registered ElementDeclHandler parses an inline     document type definition containing a deeply nested content model a C stack     overflow occurs.(CVE-2026-4224)

    http.cookies.Morsel.js_output() returns an inline script snippet and only escapes ' for JavaScript     string context. It does not neutralize the HTML parser-sensitive sequence /script inside the     generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie     value.(CVE-2026-6019)

    Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and     `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-     used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the     dangling pointer in this specific error condition.

    The vulnerability is only present if the program re-uses decompressor instances across multiple     decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions     to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and     `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor     instance is not re-used after an error condition, this usage is similarly not vulnerable.(CVE-2026-6100)

    The webbrowser.open() API would accept leading dashes in the URL which     could be handled as command line options for certain web browsers. New     behavior rejects leading dashes. Users are recommended to sanitize URLs     prior to passing to webbrowser.open().(CVE-2026-4519)

    bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data.(CVE-2026-9669)

    The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled     in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers     for this audit event therefore do not fire.(CVE-2026-2297)

    The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The     Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass     input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to     BaseCookie.output().(CVE-2026-3644)

Tenable has extracted the preceding description block directly from the EulerOS python3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1929 advisory.

    tarfile.extractall() with the 'data' or 'tar'filter could be bypassed by a crafted archive where a     hardlinkreferences a symlink stored at a deeper name than the hardlink itself.The extraction fallback     validated the symlink at it's archived locationbut recreated it at the hardlink's shallowerpath, letting a     relativetarget the filter judged contained escape the destination directory.This allowed a malicious tar     archive to create a symlink pointingoutside the destination, enabling out-of-destination file reads     orwrites. This was an incomplete fix of CVE-2025-4330. (CVE-2026-11940)

    unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input     containing long runs of combining characters with alternating Canonical Combining Class values. This     affects all normalization forms. (CVE-2026-3276)

    tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process. (CVE-2026-7774)

    The ftpcp() function in Lib/ftplib.py was not updated whenCVE-2021-4189 was fixed. While makepasv() was     patched to replaceserver-supplied PASV host addresses with the actual peer address(getpeername()[0]),     ftpcp() still calls parse227() directly and passesthe raw attacker-controllable IP address and port to     target.sendport(). This patch is related to CVE-2021-4189. (CVE-2026-8328)

    bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data. (CVE-2026-9669)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1963 advisory.

    When using the configparser module to write configuration filescontaining multi-line text values with     carriage return characters (\r) theresulting file could be injected with unexpected keys and values if     theattacker controls the written value. (CVE-2026-0864)

    tarfile.extractall() with the 'data' or 'tar'filter could be bypassed by a crafted archive where a     hardlinkreferences a symlink stored at a deeper name than the hardlink itself.The extraction fallback     validated the symlink at it's archived locationbut recreated it at the hardlink's shallowerpath, letting a     relativetarget the filter judged contained escape the destination directory.This allowed a malicious tar     archive to create a symlink pointingoutside the destination, enabling out-of-destination file reads     orwrites. This was an incomplete fix of CVE-2025-4330. (CVE-2026-11940)

    When using the tarfile module with a file opened in streaming mode (mode=r|) the tarfile module did     not properly handle EOF, making archive parsing take exponentially longer. (CVE-2026-11972)

    unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input     containing long runs of combining characters with alternating Canonical Combining Class values. This     affects all normalization forms. (CVE-2026-3276)

    bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data. (CVE-2026-9669)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1954 advisory.

    When using the configparser module to write configuration filescontaining multi-line text values with     carriage return characters (\r) theresulting file could be injected with unexpected keys and values if     theattacker controls the written value. (CVE-2026-0864)

    When using the tarfile module with a file opened in streaming mode (mode=r|) the tarfile module did     not properly handle EOF, making archive parsing take exponentially longer. (CVE-2026-11972)

    CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. (CVE-2026-1502)

    unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input     containing long runs of combining characters with alternating Canonical Combining Class values. This     affects all normalization forms. (CVE-2026-3276)

    tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process. (CVE-2026-7774)

    bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data. (CVE-2026-9669)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
327378	Amazon Linux 2023 : python3.13, python3.13-devel, python3.13-freethreading (ALAS2023-2026-1910)	Nessus	Amazon Linux Local Security Checks	7/16/2026	7/16/2026	high
328461	Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2026-1953)	Nessus	Amazon Linux Local Security Checks	7/20/2026	7/20/2026	high
325428	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Python vulnerabilities (USN-8509-1)	Nessus	Ubuntu Local Security Checks	7/7/2026	7/7/2026	critical
320094	Linux Distros Unpatched Vulnerability : CVE-2026-9669	Nessus	Misc.	6/9/2026	9/2/2026	high
343742	EulerOS 2.0 SP12 : python3 (EulerOS-SA-2026-3380)	Nessus	Huawei Local Security Checks	9/8/2026	9/8/2026	critical
327372	Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-1929)	Nessus	Amazon Linux Local Security Checks	7/16/2026	7/27/2026	high
343718	EulerOS 2.0 SP12 : python3 (EulerOS-SA-2026-3305)	Nessus	Huawei Local Security Checks	9/8/2026	9/8/2026	critical
328474	Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2026-1963)	Nessus	Amazon Linux Local Security Checks	7/20/2026	7/20/2026	high
328487	Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2026-1954)	Nessus	Amazon Linux Local Security Checks	7/20/2026	8/24/2026	high

Detections

Analytics

Plugins Search

high

high

critical

high

critical

high

critical

high

high