The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69125 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)

    * curl: curl: Information disclosure via incorrect .netrc password lookup (CVE-2026-8926)

    * curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)

    * curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)

    * curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)

    * libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials     (CVE-2026-9079)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libcurl installed on the remote host is 8.8.0 prior to 8.21.0. It is, therefore, affected by a credential disclosure vulnerability:

  - libcurl had a flaw that when instructed to clear proxy authentication credentials, it did not do so,     leaving the old credentials around to get used for subsequent transfers. (CVE-2026-9079)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21272-1 advisory.

    This update for curl fixes the following issues

    - CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
    - CVE-2026-8458: wrong reuse for different services (bsc#1268407).
    - CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
    - CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
    - CVE-2026-9079: stale proxy password leak (bsc#1268415).
    - CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
    - CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
    - CVE-2026-9547: SSH improper host validation (bsc#1268420).
    - CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
    - CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the curl package has been released.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69125 advisory.

    * libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)

    * curl: curl: Information disclosure via incorrect .netrc password lookup (CVE-2026-8926)

    * curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)

    * curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)

    * curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)

    * libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials     (CVE-2026-9079)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:69125 advisory.

    * libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)
      * curl: curl: Information disclosure via incorrect .netrc password lookup (CVE-2026-8926)
      * curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)
      * curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)
      * curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)
      * libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials     (CVE-2026-9079)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so,     leaving the old credentials around to get used for subsequent transfers that should not know nor use them.
    (CVE-2026-9079)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f26b509a1a advisory.

    - Fix HTTP/2 stream-dependency tree UAF (CVE-2026-10536)
    - Fix Native CA trust persist (CVE-2026-11564)
    - Fix stale proxy password leak (CVE-2026-9079)
    - Fix wrong reuse for different services (CVE-2026-8458)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2926-1 advisory.

    This update for curl fixes the following issues

    - CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
    - CVE-2026-8458: wrong reuse for different services (bsc#1268407).
    - CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
    - CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
    - CVE-2026-9079: stale proxy password leak (bsc#1268415).
    - CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
    - CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
    - CVE-2026-9547: SSH improper host validation (bsc#1268420).
    - CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
    - CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3043-1 advisory.

    This update for curl fixes the following issues

    - CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
    - CVE-2026-8458: wrong reuse for different services (bsc#1268407).
    - CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
    - CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
    - CVE-2026-9079: stale proxy password leak (bsc#1268415).
    - CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
    - CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
    - CVE-2026-9547: SSH improper host validation (bsc#1268420).
    - CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
    - CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
348592	RHEL 10 : curl (RHSA-2026:69125)	Nessus	Red Hat Local Security Checks	2026/9/21	2026/9/21	critical
323001	libcurl 8.8.0 < 8.21.0 Stale Proxy Password Leak	Nessus	Misc.	2026/6/26	2026/7/8	critical
326418	openSUSE 16: curl / curl-fish-completion / curl-zsh-completion / libcurl-devel / etc (openSUSE-SU-2026:21272-1)	Nessus	SuSE Local Security Checks	2026/7/12	2026/7/12	critical
334708	Photon OS 5.0: Curl PHSA-2026-5.0-90-0951	Nessus	PhotonOS Local Security Checks	2026/8/12	2026/11/3	critical
348786	RockyLinux 10 : curl (RLSA-2026:69125)	Nessus	Rocky Linux Local Security Checks	2026/9/22	2026/9/22	critical
348816	AlmaLinux 10 : curl (ALSA-2026:69125)	Nessus	Alma Linux Local Security Checks	2026/9/22	2026/9/22	critical
322465	Linux Distros Unpatched Vulnerability : CVE-2026-9079	Nessus	Misc.	2026/6/24	2026/9/22	critical
344674	Fedora 44 : curl (2026-f26b509a1a)	Nessus	Fedora Local Security Checks	2026/9/11	2026/9/11	critical
326933	SUSE SLES15 Security Update : curl (SUSE-SU-2026:2926-1)	Nessus	SuSE Local Security Checks	2026/7/15	2026/7/15	critical
327284	SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2026:3043-1)	Nessus	SuSE Local Security Checks	2026/7/16	2026/7/16	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical