According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using     XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag     siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such     as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match.(CVE-2026-6879)

    In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks.
    An affected system that extracts content from untrusted tar files could end up writing files with an     unexpected uid/gid despite the user passing filter='data' to the extract() function.(CVE-2026-4360)

    `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding     protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this     vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.(CVE-2026-7210)

    The ftpcp() function in Lib/ftplib.py was not updated when     CVE-2021-4189 was fixed. While makepasv() was patched to replace     server-supplied PASV host addresses with the actual peer address     (getpeername()[0]), ftpcp() still calls parse227() directly and passes     the raw attacker-controllable IP address and port to target.sendport(). This patch is related to     CVE-2021-4189.(CVE-2026-8328)

    unicodedata.normalize() can take excessive CPU time when processing     specially crafted Unicode input containing long runs of combining characters     with alternating Canonical Combining Class values.
    This affects all normalization forms.(CVE-2026-3276)

    When using the 'configparser' module to write configuration files     containing multi-line text values with carriage return characters (\r) the     resulting file could be injected with unexpected keys and values if the     attacker controls the written value.(CVE-2026-0864)

    When using the 'tarfile' module with a file opened in 'streaming mode' (mode='r|') the tarfile module did     not properly handle EOF, making archive parsing take exponentially longer.(CVE-2026-11972)

    tarfile.extractall() with the 'data' or 'tar'      filter could be bypassed by a crafted archive where a hardlink     references a symlink stored at a deeper name than the hardlink itself.
    The extraction fallback validated the symlink at it's archived location     but recreated it at the hardlink's shallower     path, letting a relative      target the filter judged contained escape the destination directory.
    This allowed a malicious tar archive to create a symlink pointing     outside the destination, enabling out-of-destination file reads or     writes. This was an incomplete fix of CVE-2025-4330.(CVE-2026-11940)

    http.cookies.Morsel.js_output() returns an inline script snippet and only escapes ' for JavaScript     string context. It does not neutralize the HTML parser-sensitive sequence /script inside the     generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie     value.(CVE-2026-6019)

    Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and     `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-     used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the     dangling pointer in this specific error condition.

    The vulnerability is only present if the program re-uses decompressor instances across multiple     decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions     to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and     `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor     instance is not re-used after an error condition, this usage is similarly not vulnerable.(CVE-2026-6100)

    bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data.(CVE-2026-9669)

    tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process.(CVE-2026-7774)

    The webbrowser.open() API would accept leading dashes in the URL which     could be handled as command line options for certain web browsers. New     behavior rejects leading dashes. Users are recommended to sanitize URLs     prior to passing to webbrowser.open().(CVE-2026-4519)

    The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled     in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers     for this audit event therefore do not fire.(CVE-2026-2297)

    The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The     Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass     input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to     BaseCookie.output().(CVE-2026-3644)

    When an Expat parser with a registered ElementDeclHandler parses an inline     document type definition containing a deeply nested content model a C stack     overflow occurs.(CVE-2026-4224)

Tenable has extracted the preceding description block directly from the EulerOS python3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4827 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4827-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Andrej Shadura     October 08, 2026                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : python3.11     Version        : 3.11.2-6+deb12u9     CVE ID         : CVE-2025-69534 CVE-2026-1502 CVE-2026-3276 CVE-2026-6019                      CVE-2026-8328 CVE-2026-9669 CVE-2026-15308 CVE-2026-15310                      CVE-2026-15806 CVE-2026-17084 CVE-2026-18503 CVE-2026-19445                      CVE-2026-19553     Debian Bug     : 1131896

    Multiple vulnerabilities in Python 3.11.

    CVE-2025-69534

        Malformed markup declarations could make html.parser.HTMLParser         raise an unhandled AssertionError. Applications parsing untrusted         HTML, such as Python-Markdown rendering untrusted input, could         crash, resulting in denial of service.

    CVE-2026-1502

        http.client did not reject CR/LF bytes in the proxy tunnel host or         in tunnel request headers, which could allow HTTP header injection.

    CVE-2026-3276

        unicodedata.normalize() could take excessive CPU time when         processing specially crafted Unicode input containing long runs of         combining characters with alternating canonical combining class         values. This affected all normalization forms.

    CVE-2026-6019

        http.cookies.Morsel.js_output() returned an inline <script> snippet         in which the cookie value was only escaped for the JavaScript string         context, without neutralising the </script> sequence, so         attacker-controlled cookie values could inject markup into the page.

    CVE-2026-8328

        ftplib.ftpcp() was not updated when CVE-2021-4189 was fixed and         still passed the address returned by the source server for PASV to         the target server. A malicious source FTP server could use this to         direct the target server's data connection to an arbitrary host and         port.

    CVE-2026-9669

        bz2.BZ2Decompressor objects could be reused after a decompression         error. If an application caught the resulting OSError and retried         with the same decompressor, crafted input could cause out-of-bounds         writes to a stack buffer, crashing the process.

    CVE-2026-15308

        Feeding html.parser.HTMLParser incrementally with long unterminated         constructs, such as tags or comments, took quadratic time, allowing         denial of service through CPU exhaustion.

    CVE-2026-15310

        When decompressing crafted zip files using bzip2 or LZMA         compression, zipfile could use an attacker-controlled size to         pre-allocate memory, possibly resulting in memory exhaustion.

    CVE-2026-15806

        urllib.request.HTTPPasswordMgr and its subclasses did not take the         URL scheme into account when matching stored credentials.
        Credentials added for an https:// URL were also sent to the same         host over http://, so an attacker able to redirect or downgrade a         client to plain HTTP could capture them in cleartext.

    CVE-2026-17084

        The stringprep module used current Unicode codepoint attributes         instead of those of Unicode 3.2.0, as required by RFC 3454, when         checking tables B.2 and B.3. This could cause mismatches when         processing domain names with the IDNA 2003 (idna) codec.

    CVE-2026-18503

        Attacker-controlled CSV samples could trigger super-linear regular         expression matching in csv.Sniffer.sniff(), consuming significant         CPU time.

    CVE-2026-19445

        A remote, unauthenticated TLS client could make a server crash or         call through a freed pointer if the server's sni_callback assigned a         different context to SSLSocket.context and nothing else kept the         original ssl.SSLContext alive.


    CVE-2026-19553

        ssl.SSLContext.wrap_bio() did not require the server_hostname         argument when check_hostname was enabled, so hostname verification         could be silently skipped; asyncio's create_connection() and         loop.start_tls() were affected as well. For compatibility, Python         3.11 now emits a DeprecationWarning in this case instead of raising         ValueError, so applications still need to pass a valid         server_hostname.

    For Debian 12 bookworm, these problems have been fixed in version     3.11.2-6+deb12u9.

    In addition, this update includes the following related upstream fixes:

      * csv.Sniffer.sniff() could take exponential time on samples with many         quote characters while detecting doubled quotes (gh-109638).

      * Regular expressions with possessive quantifiers could give wrong         matches when the repeated sub-pattern contained backtracking         (gh-100061, gh-106052).

      * html.parser.HTMLParser did not parse start and end tags according         to the HTML5 standard, and could lose data after an unclosed script         or style tag (gh-135661, gh-86155). As a result of the fix, some         malformed markup is parsed differently; for example, </ script>         no longer ends a script element.

    We recommend that you upgrade your python3.11 packages.

    For the detailed security status of python3.11 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python3.11

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
364930	EulerOS 2.0 SP11 : python3 (EulerOS-SA-2026-4373)	Nessus	Huawei Local Security Checks	10/12/2026	10/12/2026	critical
364182	Debian dla-4827 : idle-python3.11 - security update	Nessus	Debian Local Security Checks	10/8/2026	10/8/2026	critical

Detections

Analytics

Plugins Search

critical

critical