The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1790154364 advisory.

  - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share     connections with other handles, can lead to use-after-free in the cleanup process. (CVE-2026-18924)

  - When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification     (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key     pinning on connections established without a presented server certificate. Bypassing the pinning check     under these disabled-verification conditions allows unauthenticated connections to succeed when they     should be rejected. (CVE-2026-80230)

  - When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when     processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is     itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-     only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is     inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains     under the same public suffix (e.g., `attacker.co.uk`). (CVE-2026-82209)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the curl package has been released.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a06b828d65 advisory.

    - Fix incomplete mTLS config matching in conn reuse (CVE-2026-8932)
    - Fix OpenLDAP SASL authentication bypass (CVE-2026-13608)
    - Fix OpenSSL pinning bypass (CVE-2026-80230)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4047-1 advisory.

    - CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).
    - CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).
    - CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).
    - CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass (bsc#1277476).
    - CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free (bsc#1277479).
    - CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated connections to succeed (bsc#1277480).

    Changes for curl:

    - Call http_size() first to prioritize Transfer-Encoding: chunked over a zero      Content-Length empty body check (bsc#1264971)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21774-1 advisory.

    - CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).
    - CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).
    - CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).
    - CVE-2026-13608: OpenLDAP SASL authentication bypass (bsc#1277476).
    - CVE-2026-80229: OpenSSL provider use-after-free (bsc#1277479).
    - CVE-2026-80230: OpenSSL pinning bypass (bsc#1277480).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1789899321 advisory.

  - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share     connections with other handles, can lead to use-after-free in the cleanup process. (CVE-2026-18924)

  - When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification     (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key     pinning on connections established without a presented server certificate. Bypassing the pinning check     under these disabled-verification conditions allows unauthenticated connections to succeed when they     should be rejected. (CVE-2026-80230)

  - When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when     processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is     itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-     only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is     inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains     under the same public suffix (e.g., `attacker.co.uk`). (CVE-2026-82209)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent     handle is set to share connections with other handles, can lead to     use-after-free in the cleanup process.(CVE-2026-18924)

    Successfully using libcurl to do a transfer to a specific HTTP origin     (`hostA`) with **Digest** authentication and then changing the origin to a     different one (`hostB`) for a second transfer, reusing the same handle, makes     libcurl wrongly pass on the `Authorization:` header field meant for `hostA`,     to `hostB`.(CVE-2026-11856)

    When libpsl support is enabled, libcurl fails to enforce the Public Suffix     List boundary check when processing a `Set-Cookie` header where the `Domain`     attribute explicitly matches an origin host that is itself a public suffix     (e.g., `Domain=co.uk` set by `co.uk`).

    Instead of coercing it into a strict host-only cookie, libcurl saves the     cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is     inappropriately included in subsequent outbound requests or HTTP redirects to     arbitrary sibling subdomains under the same public suffix (e.g.,     `attacker.co.uk`).(CVE-2026-82209)

    libcurl would reuse a previously created connection even when some mTLS config     related option had been changed that should have prohibited reuse.

    libcurl keeps previously used connections in a connection pool for subsequent     transfers to reuse if one of them matches the setup. However, some TLS     settings related to client certificates were left out from the configuration     match checks, making them match too easily. In particular options related to     the private key.(CVE-2026-8932)

    When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable     standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and     `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on     connections established without a presented server certificate. Bypassing the     pinning check under these disabled-verification conditions allows     unauthenticated connections to succeed when they should be rejected.(CVE-2026-80230)

    A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup     for a given hostname even when using a different Native CA Store setting     (`CURLSSLOPT_NATIVE_CA`) than when the connection was created.(CVE-2026-80231)

    A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given     hostname using Negotiate authentication, when the initial request is done     using empty credentials. This can make user B's request get sent over user A's     previously authenticated connection.(CVE-2026-19931)

Tenable has extracted the preceding description block directly from the EulerOS curl security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202611-07 (curl: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in curl. Please review the CVE identifiers referenced below     for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4048-1 advisory.

    - CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass (bsc#1277476).
    - CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free (bsc#1277479).
    - CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated connections to succeed (bsc#1277480).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
360071	AlmaLinux 9.2 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1790154364)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/1	critical
375018	Photon OS 5.0: Curl PHSA-2026-5.0-90-1049	Nessus	PhotonOS Local Security Checks	2026/11/2	2026/11/2	critical
365519	Fedora 44 : curl (2026-a06b828d65)	Nessus	Fedora Local Security Checks	2026/10/14	2026/10/14	high
348459	SUSE SLES15 Security Update : curl (SUSE-SU-2026:4047-1)	Nessus	SuSE Local Security Checks	2026/9/21	2026/9/21	high
343957	openSUSE 16: curl / curl-fish-completion / curl-zsh-completion / libcurl-devel / etc (openSUSE-SU-2026:21774-1)	Nessus	SuSE Local Security Checks	2026/9/9	2026/9/9	high
360930	CentOS Linux 8.4 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1789899321)	Nessus	CentOS Local Security Checks	2026/10/1	2026/10/1	critical
376698	EulerOS 2.0 SP12 : curl (EulerOS-SA-2026-4474)	Nessus	Huawei Local Security Checks	2026/11/6	2026/11/6	critical
379442	GLSA-202611-07 : curl: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2026/11/12	2026/11/12	medium
348465	SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2026:4048-1)	Nessus	SuSE Local Security Checks	2026/9/21	2026/9/21	high
375012	Photon OS 5.0: Curl PHSA-2026-5.0-91-1008	Nessus	PhotonOS Local Security Checks	2026/11/2	2026/11/2	critical
375029	Photon OS 4.0: Curl PHSA-2026-4.0-1092	Nessus	PhotonOS Local Security Checks	2026/11/2	2026/11/2	critical
375119	Photon OS 5.0: Curl PHSA-2026-5.0-92-1008	Nessus	PhotonOS Local Security Checks	2026/11/2	2026/11/2	critical
376758	EulerOS 2.0 SP12 : curl (EulerOS-SA-2026-4397)	Nessus	Huawei Local Security Checks	2026/11/6	2026/11/6	critical

偵測

搜尋 Plugin

critical

critical

high

high

high

critical

critical

medium

high

critical

critical

critical

critical