The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992142 advisory.

    The 'zipfile' module would not check the validity of the ZIP64 End of     Central Directory (EOCD) Locator record offset value would not be used to     locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be     assumed to be the previous record in the ZIP archive. This could be abused     to create ZIP archives that are handled differently by the 'zipfile' module     compared to other ZIP implementations.


    Remediation maintains this behavior, but checks that the offset specified     in the ZIP64 EOCD Locator record matches the expected value.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:0123 advisory.

    * cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked     (CVE-2025-8291)
      * cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service     (CVE-2025-12084)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0133-1 advisory.

    - CVE-2025-8291: check validity of the ZIP64 End of Central Directory (EOCD) in the 'zipfile' module     (bsc#1251305).
    - CVE-2025-12084: prevent quadratic behavior in node ID cache clearing (bsc#1254997).
    - CVE-2025-13836: prevent reading an HTTP response from a server, if no read amount is specified, with     using Content-Length per default as the length (bsc#1254400).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4445 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4445-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Andrej Shadura     January 20, 2026                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : python3.9     Version        : 3.9.2-1+deb11u4     CVE ID         : CVE-2022-37454 CVE-2025-4516 CVE-2025-6069 CVE-2025-6075                      CVE-2025-8194 CVE-2025-8291 CVE-2025-12084 CVE-2025-13836                      CVE-2025-13837

    Multiple security fixes in cPython 3.9.

    CVE-2022-37454

        The Keccak XKCP SHA-3 implementation had an integer overflow         and a buffer overflow in the sponge function interface. This         allowed attackers to execute arbitrary code or eliminate expected         cryptographic properties.

    CVE-2025-4516

        An issue in bytes.decode(unicode_escape, error=ignore|replace)         could result in a crash.

    CVE-2025-6069

        The html.parser.HTMLParser class had worse-case quadratic complexity         when processing certain crafted malformed inputs potentially leading         to amplified denial-of-service.

    CVE-2025-6075

        If the value passed to os.path.expandvars() is user-controlled         a performance degradation was possible when expanding environment         variables.

    CVE-2025-8194

        The tar implementation would process tar archives with negative         offsets without error, resulting in an infinite loop and deadlock         during the parsing of maliciously crafted tar archives.

    CVE-2025-8291

        The 'zipfile' module would not check the validity of the ZIP64 End         of Central Directory (EOCD) Locator record offset value would not be         used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record         would be assumed to be the previous record in the ZIP archive. This         could be abused to create ZIP archives that are handled differently         by the 'zipfile' module compared to other ZIP implementations.

    CVE-2025-12084

        When building nested elements using xml.dom.minidom methods such         as appendChild() that have a dependency on _clear_id_cache() the         algorithm was quadratic. Availability could be impacted when building         excessively nested documents.

    CVE-2025-13836

        When reading an HTTP response from a server, if no read amount was         specified, the default behavior was to use Content-Length. This         allowed a malicious server to cause the client to read large amounts         of data into memory, potentially causing OOM or other DoS.

    CVE-2025-13837

        When loading a plist file, the plistlib module would read data in         size specified by the file itself, meaning a malicious file could         cause OOM and DoS issues.

    For Debian 11 bullseye, these problems have been fixed in version     3.9.2-1+deb11u4.

    We recommend that you upgrade your python3.9 packages.

    For the detailed security status of python3.9 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python3.9

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779213441 advisory.

  - CPython 3.9 and earlier doesn't disallow configuring an empty list ([]) for     SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a     buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity     due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically     a protocol name would be configured). (CVE-2024-5642)

  - When folding a long comment in an email header containing exclusively unfoldable characters, the     parenthesis would not be preserved. This could be used for injecting headers into email messages where     addresses are user-controlled and not sanitized. (CVE-2025-11468)

  - User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in     the data URL mediatype. (CVE-2025-15282)

  - The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted     malformed inputs potentially leading to amplified denial-of-service. (CVE-2025-6069)

  - When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP     headers into messages. Patch rejects all control characters within cookie names, values, and parameters.
    (CVE-2026-0672)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
280075	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2025-992142)	Nessus	Unity Linux Local Security Checks	12/26/2025	12/26/2025	medium
282354	AlmaLinux 8 : python3.12 (ALSA-2026:0123)	Nessus	Alma Linux Local Security Checks	1/7/2026	1/7/2026	medium
291280	SUSE SLES12: libpython2_7-1_0 / libpython2_7-1_0-32bit / python / python-32bit / etc (SUSE-SU-2026:0133-1)	Nessus	SuSE Local Security Checks	1/17/2026	6/26/2026	medium
294786	Debian dla-4445 : idle-python3.9 - security update	Nessus	Debian Local Security Checks	1/20/2026	4/30/2026	medium
296562	openSUSE 16 Security Update : python313 (openSUSE-SU-2026:20081-1)	Nessus	SuSE Local Security Checks	1/26/2026	4/30/2026	medium
351547	Rocky Linux 9.6 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1779213441)	Nessus	Rocky Linux Local Security Checks	9/30/2026	9/30/2026	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium