There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs.
    When resolving dependencies in versions before 9.3.0, some exceptions were not treated as fatal errors and
    would not cause a repository to be disabled. If a build encountered one of these exceptions, Gradle would
    continue to the next repository in the list and potentially resolve dependencies from a different
    repository. If a Gradle build used an unresolvable host name, Gradle would continue to work as long as all
    dependencies could be resolved from another repository. An unresolvable host name could be caused by
    allowing a repository's domain name registration to lapse or typo-ing the real domain name. This behavior
    could allow an attacker to register a service under the host name used by the build and serve malicious
    artifacts. The attack requires the repository to be listed before others in the build configuration.
    Gradle has introduced a change in behavior in Gradle 9.3.0 to stop searching other repositories when
    encountering these errors. (CVE-2026-22816)

  - Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs.
    When resolving dependencies in versions before 9.3.0, some exceptions were not treated as fatal errors and
    would not cause a repository to be disabled. If a build encountered one of these exceptions, Gradle would
    continue to the next repository in the list and potentially resolve dependencies from a different
    repository. An exception like NoHttpResponseException can indicate transient errors. If the errors persist
    after a maximum number of retries, Gradle would continue to the next repository. This behavior could allow
    an attacker to disrupt the service of a repository and leverage another repository to serve malicious
    artifacts. This attack requires the attacker to have control over a repository after the disrupted
    repository. Gradle has introduced a change in behavior in Gradle 9.3.0 to stop searching other
    repositories when encountering these errors. (CVE-2026-22865)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs.
    When resolving dependencies in versions before 9.3.0, some exceptions were not treated as fatal errors and
    would not cause a repository to be disabled. If a build encountered one of these exceptions, Gradle would
    continue to the next repository in the list and potentially resolve dependencies from a different
    repository. If a Gradle build used an unresolvable host name, Gradle would continue to work as long as all
    dependencies could be resolved from another repository. An unresolvable host name could be caused by
    allowing a repository's domain name registration to lapse or typo-ing the real domain name. This behavior
    could allow an attacker to register a service under the host name used by the build and serve malicious
    artifacts. The attack requires the repository to be listed before others in the build configuration.
    Gradle has introduced a change in behavior in Gradle 9.3.0 to stop searching other repositories when
    encountering these errors. (CVE-2026-22816)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - Gradle 是一個構建自動化工具，其原生平台工具為原生 API 提供 Java 繫結。
    在之前 9.3.0版本中解析相依性時，某些例外狀況不會被視為重大錯誤，也不會導致存放庫被停用。如果組建遇到其中一個例外狀況，Gradle 會繼續前往清單中的下一個存放區，並可能解決來自不同存放區的依附元件。如果 Gradle 組建使用無法解析的主機名稱，只要所有依附元件都可以從另一個存放庫解析，Gradle 就會繼續運作。無法解析的主機名稱可能是因為允許存放庫的網域名稱註冊失效或真實網域名稱有錯別字。此行為可讓攻擊者以組建所使用的主機名稱註冊服務，並提供惡意成品。此攻擊要求存放庫在組建設定中列在其他存放庫之前。
    Gradle 已變更 Gradle 9.3.0 的行為，以便在遇到這些錯誤時停止搜尋其他存放區。（CVE-2026-22816）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Gradle 是一款构建自动化工具，其本机平台工具为本机 API 提供 Java 绑定。
    解决之前 9.3.0版本中的依存关系时，某些异常未被视为致命错误，并且不会导致存储库被禁用。如果版本遇到上述异常之一，Gradle 会继续进行列表中的下一个存储库，并可能解决不同存储库的依赖项。如果 Gradle 版本使用了无法解析的主机名，只要可以从另一个存储库解析所有依赖项，Gradle 就会继续工作。无法解析主机名的原因是允许存储库的域名注册失效或拼写错误实际域名。此行为可允许攻击者以版本所使用的主机名注册服务，并为恶意构件提供服务。此攻击需要在生成配置中排在其他存储库之前列出。
    Gradle 在 Gradle 9.3.0 中引入了行为变更，以便在遇到这些错误时停止搜索其他存储库。（CVE-2026-22816）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Gradle はビルド自動化ツールであり、そのネイティブプラットフォームツールはネイティブ API 用の Java バインディングを提供します。
    9.3.0 より前のバージョンの依存関係を解決する際、一部の例外が致命的なエラーとして扱われず、リポジトリを無効にしないことがありました。ビルドでこれらの例外のいずれかが発生した場合、Gradleはリスト内の次のリポジトリに進み、別のリポジトリからの依存関係を解決する可能性があります。Gradleビルドで解決不能なホスト名が使用されていた場合、すべての依存関係が別のリポジトリから解決できる限り、Gradleは機能し続けます。リポジトリのドメイン名登録の失効を許したり、本当のドメイン名を誤植したりすることで、解決不能なホスト名が発生する可能性があります。この動作により、攻撃者が、ビルドで使用されているホスト名でサービスを登録し、悪意のあるアーティファクトを提供する可能性があります。この攻撃では、リポジトリをビルド構成で他のリポジトリの前にリストする必要があります。
    Gradleでは、Gradle 9.3.0 に挙動の変更が導入され、これらのエラーが発生した場合に他のリポジトリの検索を停止しました。(CVE-2026-22816)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs.
    When resolving dependencies in versions before 9.3.0, some exceptions were not treated as fatal errors and     would not cause a repository to be disabled. If a build encountered one of these exceptions, Gradle would     continue to the next repository in the list and potentially resolve dependencies from a different     repository. If a Gradle build used an unresolvable host name, Gradle would continue to work as long as all     dependencies could be resolved from another repository. An unresolvable host name could be caused by     allowing a repository's domain name registration to lapse or typo-ing the real domain name. This behavior     could allow an attacker to register a service under the host name used by the build and serve malicious     artifacts. The attack requires the repository to be listed before others in the build configuration.
    Gradle has introduced a change in behavior in Gradle 9.3.0 to stop searching other repositories when     encountering these errors. (CVE-2026-22816)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名稱	產品	系列	已發布	已更新	嚴重性
441026	Alpine: gradle: security update to 8.14.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2026/4/30	2026/7/2	high
476278	Chainguard: gradle-8: security update to 8.14.4-r0	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	2026/10/20	2026/10/21	high
441026	Alpine: gradle: security update to 8.14.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2026/4/30	2026/7/2	high
476278	Chainguard: gradle-8: security update to 8.14.4-r0	Tenable Cloud Security	Chainguard Local Security Checks	2026/10/20	2026/10/21	high
291294	Linux Distros 未修補的弱點：CVE-2026-22816	Nessus	Misc.	2026/1/17	2026/10/28	high
291294	Linux Distros 未修补的漏洞：CVE-2026-22816	Nessus	Misc.	2026/1/17	2026/10/28	high
291294	Linux Distros のパッチ未適用の脆弱性: CVE-2026-22816	Nessus	Misc.	2026/1/17	2026/10/28	high
291294	Linux Distros Unpatched Vulnerability : CVE-2026-22816	Nessus	Misc.	2026/1/17	2026/10/28	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high