The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6841033933 advisory.

    - fix HTTP/2 stream-dependency tree UAF (CVE-2026-10536)
    - fix stale proxy password leak (CVE-2026-9079)
    - fix wrong reuse for different services (CVE-2026-8458)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72506 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: libcurl: Improper certificate validation due to cached TLS settings reuse (CVE-2025-14819)

    * curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication     (CVE-2026-1965)

    * curl: curl: Unauthorized access due to improper HTTP proxy connection reuse (CVE-2026-3784)

    * curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect     (CVE-2026-3783)

    * curl: curl: Man-in-the-middle attack via SSH host key bypass (CVE-2026-9547)

    * libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)

    * curl: curl: Information disclosure via incorrect .netrc password lookup (CVE-2026-8926)

    * curl: curl: Insecure connection establishment due to TLS configuration mismatch (CVE-2026-8286)

    * curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)

    * curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)

    * curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)

    * curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP (CVE-2026-12064)

    * curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927)

    * libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials     (CVE-2026-9079)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8487-1 advisory.

    Andrew Nesbitt discovered that curl could reuse an existing live connection during STARTTLS-based     connection upgrades even when the TLS configuration did not match. A remote attacker could possibly use     this issue to cause curl to use an unintended TLS configuration. (CVE-2026-8286)

    Muhamad Arga Reksapati discovered that curl incorrectly reused connections for Negotiate-authenticated     requests when different services were involved. A remote attacker could possibly use this issue to access     resources authenticated for another service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,     Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-8458)

    It was discovered that curl incorrectly handled cookie parsing in certain circumstances. A remote attacker     could possibly use this issue to set cookies that would be transmitted to unrelated third-party domains.
    This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu     24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-8924)

    Joshua Rogers discovered that curl could double-free a GSASL context when handling SASL authentication. A     remote attacker could possibly use this issue to cause a denial of service, or execute arbitrary code.
    This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS.
    (CVE-2026-8925)

    Joshua Rogers discovered that curl could select the wrong password from a .netrc file when a username was     specified in the URL without a password. A remote attacker could possibly use this issue to obtain     sensitive information. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-8926)

    Ady Elouej discovered that curl did not clear proxy authentication state between requests when reusing a     handle with environment-variable proxy configuration. A remote attacker could possibly use this issue to     obtain sensitive credentials. (CVE-2026-8927)

    Guannan Wang, Zhanpeng Liu, Jiashuo Liang, and Guancheng Li discovered that curl did not properly clear     proxy authentication credentials when instructed to do so. A remote attacker could possibly use this issue     to obtain sensitive credentials. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS.
    (CVE-2026-9079)

    Joshua Rogers discovered that curl contained a use-after-free when curl_easy_pause() was called within the     event-based socket callback. A remote attacker could possibly use this issue to cause a denial of service     or possibly execute arbitrary code. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS.
    (CVE-2026-9080)

    Eunsoo Kim discovered that curl could send early data on a resumed TLS session before enforcing     certificate verification failure. A machine-in-the-middle attacker could possibly use this issue to obtain     sensitive information. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-9545)

    Joshua Rogers discovered that curl did not properly reject host key type mismatches when using the SSH key     callback for SCP and SFTP transfers. A machine-in-the-middle attacker could possibly use this issue to     impersonate a trusted server. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10,     and Ubuntu 26.04 LTS. (CVE-2026-9547)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-69125 advisory.

    - fix cookie injection via trailing dot super cookies (CVE-2026-8924)
    - fix digest auth state leak on origin or credential change (CVE-2026-11856)
    - fix netrc password lookup for non-matching login (CVE-2026-8926)
    - fix proxy auth not cleared properly on NULL (CVE-2026-9079)
    - fix incomplete mTLS config in connection reuse and session cache       (CVE-2026-8932)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202611-07 (curl: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in curl. Please review the CVE identifiers referenced below     for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2132 advisory.

    A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-     dependency tree via CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, subsequently invokes     curl_easy_reset(), and finally terminates the handle with curl_easy_cleanup(). During this final cleanup     phase, libcurl attempts to access and modify an internal structure that was already freed during the reset     operation. (CVE-2026-10536)

    By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on     memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by     flooding curl with rapid, sequential PING messages. (CVE-2026-11586)

    Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication     and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle,     makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB. (CVE-2026-11856)

    When a user invokes curl using a schemeless URL combined with --proto-default sftp (or scp), a disconnect     occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which     erroneously bypasses the initialization of critical SSH security options like     CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime     successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified.
    Because the tool layer skipped the security configuration, these SSH host verification options are     silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.
    (CVE-2026-12064)

    A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an     existing live connection even though the TLS configuration mismatches so it should not. (CVE-2026-8286)

    libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated     ones, even when they are set to use different services.

    libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection     to avoid overhead.

    When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request     that was issued by an application could wrongfully reuse an existing connection to the same server that     was authenticated using different services. (CVE-2026-8458)

    A flaw in curl's cookie parsing logic allows a malicious HTTP server to set super cookies that bypass     the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl     subsequently scopes and transmits to unrelated third-party domains. (CVE-2026-8924)

    The curl logic that works with SASL authentication could end up cleaning up the GSASL context twice     without clearing the pointer in between, making it free() the same pointer twice. (CVE-2026-8925)

    When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a     username (without a password), like https://user@example.com/, curl could wrongly get and use the password     for another user set in the .netrc file for that host if such a one exists and there is no match for the     specified user. (CVE-2026-8926)

    When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration,     libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial     transfer authenticates against proxyA using Digest auth, a subsequent transfer routed through proxyB     erroneously leaks the Proxy-Authorization: header intended solely for proxyA. (CVE-2026-8927)

    libcurl would reuse a previously created connection even when some mTLS config related option had been     changed that should have prohibited reuse.

    libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of     them matches the setup. However, some TLS settings related to client certificates were left out from the     configuration match checks, making them match too easily. In particular options related to the private     key. (CVE-2026-8932)

    libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so,     leaving the old credentials around to get used for subsequent transfers that should not know nor use them.
    (CVE-2026-9079)

    Calling curl_easy_pause() within the event-based CURLMOPT_SOCKETFUNCTION callback triggers a use-after-     free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately     after that pointer's memory has been freed. (CVE-2026-9080)

    In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a     second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid     certificate.

    When libcurl returns to the hostname the second time with a cached SSL session     (CURLOPT_SSL_SESSIONID_CACHE is not disabled) and early data enabled (the CURLSSLOPT_EARLYDATA bit is set     in CURLOPT_SSL_OPTIONS), libcurl might send off the second request's bytes on that new connection before     enforcing the certificate verification failure. Potentially leaking sensitive information. (CVE-2026-9545)

    When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the     CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. This vulnerability occurs     when a server presents a host key type that does not match the specific key type already recorded for that     host in the known_hosts file. Instead of rejecting the mismatch, the callback mechanism fails to properly     enforce the restriction, allowing the connection to succeed without warning and risking a potential man-     in-the-middle attack. (CVE-2026-9547)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69125 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)

    * curl: curl: Information disclosure via incorrect .netrc password lookup (CVE-2026-8926)

    * curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)

    * curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)

    * curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)

    * libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials     (CVE-2026-9079)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libcurl installed on the remote host is 8.8.0 prior to 8.21.0. It is, therefore, affected by a credential disclosure vulnerability:

  - libcurl had a flaw that when instructed to clear proxy authentication credentials, it did not do so,     leaving the old credentials around to get used for subsequent transfers. (CVE-2026-9079)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21272-1 advisory.

    This update for curl fixes the following issues

    - CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
    - CVE-2026-8458: wrong reuse for different services (bsc#1268407).
    - CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
    - CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
    - CVE-2026-9079: stale proxy password leak (bsc#1268415).
    - CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
    - CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
    - CVE-2026-9547: SSH improper host validation (bsc#1268420).
    - CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
    - CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
344670	Fedora 43 : curl (2026-6841033933)	Nessus	Fedora Local Security Checks	2026/9/11	2026/10/9	critical
350938	RHEL 10 : curl (RHSA-2026:72506)	Nessus	Red Hat Local Security Checks	2026/9/29	2026/9/29	critical
324983	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : curl vulnerabilities (USN-8487-1)	Nessus	Ubuntu Local Security Checks	2026/7/3	2026/7/8	critical
349487	Oracle Linux 10 : curl (ELSA-2026-69125)	Nessus	Oracle Linux Local Security Checks	2026/9/23	2026/9/23	critical
374269	Nessus Network Monitor < 6.6.0 Multiple Vulnerabilities (TNS-2026-32)	Nessus	Misc.	2026/10/30	2026/11/2	high
379442	GLSA-202611-07 : curl: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2026/11/12	2026/11/12	medium
345801	Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2026-2132)	Nessus	Amazon Linux Local Security Checks	2026/9/14	2026/9/14	critical
348592	RHEL 10 : curl (RHSA-2026:69125)	Nessus	Red Hat Local Security Checks	2026/9/21	2026/9/21	critical
323001	libcurl 8.8.0 < 8.21.0 Stale Proxy Password Leak	Nessus	Misc.	2026/6/26	2026/7/8	critical
326418	openSUSE 16: curl / curl-fish-completion / curl-zsh-completion / libcurl-devel / etc (openSUSE-SU-2026:21272-1)	Nessus	SuSE Local Security Checks	2026/7/12	2026/7/12	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

high

medium

critical

critical

critical

critical