Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - gitoxide 的 gix-url crate （<= 0.32.0，修正於 0.37.1） 使用手捲 URL 剖析器，該剖析器不會將 '？' 或 '#' 視為終止授權元件，這違反了 RFC 3986。因此，gix-transport 的HTTP重新導向身分保護 （can_reuse_identity） 會比較錯誤的主機並失敗開啟。控制重新導向回應的攻擊者可以製作 ？@<original-authority> 格式<attacker-authority>的 Location 標頭，以便 gitoxide 將呼叫端的 HTTP 基本授權憑證傳送至非預期的主機。
    gix-transport 在 <= 0.49.0 版中受到影響 （已 0.58.1修正）。（CVE-2026-82247）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - gitoxide 的 gix-url crate（<= 0.32.0，已修复 0.37.1）使用未将“？”或“#”视为终止颁发机构组件的手动 URL 解析器，这与 RFC 3986 相反。因此，gix-transport 的 HTTP 重定向身份防护 （can_reuse_identity） 会比较错误的主机并发生打开情况失败。控制重定向响应的攻击者可制作 ？@<original-authority> 形式的 <attacker-authority>Location 标头，以便 gitoxide 将调用者的 HTTP 基本授权凭据发送到非预期主机。
    GIX-transport 在版本 <= 0.49.0 中受到影响（已在 中修复）。 0.58.1（CVE-2026-82247）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - gitoxide の gix-url クレート(<= 0.32.0、 0.37.1 で修正)は、RFC 3986 に反して、「?」または「#」を権限コンポーネントの終了として処理しない手動ロール URL パーサーを使用します。その結果、gix-transportのHTTPリダイレクトIDガード(can_reuse_identity)は誤ったホストを比較し、オープンに失敗します。リダイレクト応答を制御する攻撃者が、 <attacker-authority>?@<original-authority> 形式のLocationヘッダーを作り上げて、gitoxideが呼び出し元のHTTPの基本認証情報を意図しないホストに送信するようにする可能性があります。
    gix-transport はバージョン <= 0.49.0 で影響を受けます( 0.58.1 で修正済み)。(CVE-2026-82247)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat     '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's     HTTP redirect identity guard (can_reuse_identity) compares the wrong host and fails open. An attacker     controlling a redirect response can craft a Location header of the form <attacker-authority>?@<original-     authority> so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host.
    gix-transport is affected in versions <= 0.49.0 (fixed in 0.58.1). (CVE-2026-82247)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3382 advisory.

    gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat     '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's     HTTP redirect identity guard (can_reuse_identity) compares the wrong host and fails open. An attacker     controlling a redirect response can craft a Location header of the form <attacker-authority>?@<original-     authority> so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host.
    gix-transport is affected in versions <= 0.49.0 (fixed in 0.58.1). (CVE-2026-82247)

    gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential     helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol     fields and cause credential helpers to return credentials for attacker-specified hosts instead of the     requested URL. (CVE-2026-82249)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3381 advisory.

    gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat     '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's     HTTP redirect identity guard (can_reuse_identity) compares the wrong host and fails open. An attacker     controlling a redirect response can craft a Location header of the form <attacker-authority>?@<original-     authority> so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host.
    gix-transport is affected in versions <= 0.49.0 (fixed in 0.58.1). (CVE-2026-82247)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of rust installed on the remote host is prior to 1.99.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4072 advisory.

    gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat     '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's     HTTP redirect identity guard (can_reuse_identity) compares the wrong host and fails open. An attacker     controlling a redirect response can craft a Location header of the form <attacker-authority>?@<original-     authority> so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host.
    gix-transport is affected in versions <= 0.49.0 (fixed in 0.58.1). (CVE-2026-82247)

    gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential     helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol     fields and cause credential helpers to return credentials for attacker-specified hosts instead of the     requested URL. (CVE-2026-82249)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
341555	Linux Distros 未修補弱點：CVE-2026-82247	Nessus	Misc.	2026/8/29	2026/9/16	high
341555	Linux Distros 未修补的漏洞：CVE-2026-82247	Nessus	Misc.	2026/8/29	2026/9/16	high
341555	Linux Distros のパッチ未適用の脆弱性: CVE-2026-82247	Nessus	Misc.	2026/8/29	2026/9/16	high
341555	Linux Distros Unpatched Vulnerability : CVE-2026-82247	Nessus	Misc.	2026/8/29	2026/9/16	high
377917	Amazon Linux 2023 : cargo, clippy, rust (ALAS2023-2026-3382)	Nessus	Amazon Linux Local Security Checks	2026/11/9	2026/11/9	high
377904	Amazon Linux 2023 : cargo-c (ALAS2023-2026-3381)	Nessus	Amazon Linux Local Security Checks	2026/11/9	2026/11/9	high
377948	Amazon Linux 2 : rust (ALAS-2026-4072)	Nessus	Amazon Linux Local Security Checks	2026/11/9	2026/11/9	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high