There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network thus leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791

An update of the grpc package has been released.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1357 advisory.

    There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero     copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption     issues. The data sent by the application may be corrupted before transmission over the network thus     leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend     upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791 (CVE-2024-11407)

    LuaJIT through 2.1 has a stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c. (CVE-2024-25176)

    LuaJIT through 2.1 has an unsinking of IR_FSTORE for NULL metatable, which leads to Denial of Service     (DoS). (CVE-2024-25177)

    LuaJIT through 2.1 has an out-of-bounds read in the stack-overflow handler in lj_state.c (CVE-2024-25178)

    When libcurl is asked to perform automatic gzip decompression ofcontent-encoded HTTP responses with the     `CURLOPT_ACCEPT_ENCODING` option,**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow     wouldmake libcurl perform a buffer overflow. (CVE-2025-0725)

    Envoy is an open source L7 proxy and communication bus designed for large modern service oriented     architectures. Versions 1.34.0 through 1.34.4 and 1.35.0 contain a use-after-free (UAF) vulnerability in     the DNS cache, causing abnormal process termination. The vulnerability is in Envoy's Dynamic Forward Proxy     implementation, occurring when a completion callback for a DNS resolution triggers new DNS resolutions or     removes existing pending resolutions. This condition may occur when the following conditions are met:
    dynamic Forwarding Filter is enabled, the `envoy.reloadable_features.dfp_cluster_resolves_hosts` runtime     flag is enabled, and the Host header is modified between the Dynamic Forwarding Filter and Router filters.
    This issue is resolved in versions 1.34.5 and 1.35.1. To work around this issue, set the     envoy.reloadable_features.dfp_cluster_resolves_hosts runtime flag to false. (CVE-2025-54588)

    Envoy is an open source L7 proxy and communication bus designed for large modern service oriented     architectures. In versions below 1.32.10 and 1.33.0 through 1.33.6, 1.34.0 through 1.34.4 and 1.35.0,     insufficient Session Expiration in the Envoy OAuth2 filter leads to failed logout operations. When     configured with __Secure- or __Host- prefixed cookie names, the filter fails to append the required Secure     attribute to the Set-Cookie header during deletion. Modern browsers ignore this invalid request, causing     the session cookie to persist. This allows a user to remain logged in after they believe they have logged     out, creating a session hijacking risk on shared computers. The current implementation iterates through     the configured cookie names to generate deletion headers but does not check for these prefixes. This     failure to properly construct the deletion header means the user's session cookies are never removed by     the browser, leaving the session active and allowing the next user of the same browser to gain     unauthorized access to the original user's account and data. This is fixed in versions 1.32.10, 1.33.7,     1.34.5 and 1.35.1. (CVE-2025-55162)

    Envoy is a cloud-native, open source edge and service proxy. Prior to 1.36.1, 1.35.5, 1.34.9, and 1.33.10,     large requests and responses can potentially trigger TCP connection pool crashes due to flow control     management in Envoy. It will happen when the connection is closing but upstream data is still coming,     resulting in a buffer watermark callback nullptr reference. The vulnerability impacts TCP proxy and HTTP 1     & 2 mixed use cases based on ALPN. This vulnerability is fixed in 1.36.1, 1.35.5, 1.34.9, and 1.33.10.
    (CVE-2025-62409)

    Envoy is an open source edge and service proxy. Envoy versions earlier than 1.36.2, 1.35.6, 1.34.10, and     1.33.12 contain a use-after-free vulnerability in the Lua filter. When a Lua script executing in the     response phase rewrites a response body so that its size exceeds the configured     per_connection_buffer_limit_bytes (default 1MB), Envoy generates a local reply whose headers override the     original response headers, leaving dangling references and causing a crash. This results in denial of     service. Updating to versions 1.36.2, 1.35.6, 1.34.10, or 1.33.12 fixes the issue. Increasing     per_connection_buffer_limit_bytes (and for HTTP/2 the initial_stream_window_size) or increasing     per_request_buffer_limit_bytes / request_body_buffer_limit can reduce the likelihood of triggering the     condition but does not correct the underlying memory safety flaw. (CVE-2025-62504)

    Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier,     Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allow_missing_or_failed     is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails. This is     caused by a re-entry bug in the JwksFetcherImpl. When the first token's JWKS fetch fails, onJwksError()     callback triggers processing of the second token, which calls fetch() again on the same fetcher object.
    The original callback's reset() then clears the second fetch's state (receiver_ and request_) which causes     a crash when the async HTTP response arrives. (CVE-2025-64527)

    Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier,     when Envoy is configured in TCP proxy mode to handle CONNECT requests, it accepts client data before     issuing a 2xx response and forwards that data to the upstream TCP connection. If a forwarding proxy     upstream from Envoy then responds with a non-2xx status, this can cause a de-synchronized CONNECT tunnel     state. By default Envoy continues to allow early CONNECT data to avoid disrupting existing deployments.
    The envoy.reloadable_features.reject_early_connect_data runtime flag can be set to reject CONNECT requests     that send data before a 2xx response when intermediaries upstream from Envoy may reject establishment of a     CONNECT tunnel. (CVE-2025-64763)

    Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier,     Envoy's mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates     containing an embedded null byte (\0) inside an OTHERNAME SAN value as valid matches. (CVE-2025-66220)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ecs-service-connect-agent installed on the remote host is prior to v1.34.4.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2025-093 advisory.

    There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero     copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption     issues. The data sent by the application may be corrupted before transmission over the network thus     leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend     upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791 (CVE-2024-11407)

    LuaJIT through 2.1 has a stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c. (CVE-2024-25176)

    LuaJIT through 2.1 has an unsinking of IR_FSTORE for NULL metatable, which leads to Denial of Service     (DoS). (CVE-2024-25177)

    LuaJIT through 2.1 has an out-of-bounds read in the stack-overflow handler in lj_state.c (CVE-2024-25178)

    When libcurl is asked to perform automatic gzip decompression ofcontent-encoded HTTP responses with the     `CURLOPT_ACCEPT_ENCODING` option,**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow     wouldmake libcurl perform a buffer overflow. (CVE-2025-0725)

    Envoy is an open source L7 proxy and communication bus designed for large modern service oriented     architectures. Versions 1.34.0 through 1.34.4 and 1.35.0 contain a use-after-free (UAF) vulnerability in     the DNS cache, causing abnormal process termination. The vulnerability is in Envoy's Dynamic Forward Proxy     implementation, occurring when a completion callback for a DNS resolution triggers new DNS resolutions or     removes existing pending resolutions. This condition may occur when the following conditions are met:
    dynamic Forwarding Filter is enabled, the `envoy.reloadable_features.dfp_cluster_resolves_hosts` runtime     flag is enabled, and the Host header is modified between the Dynamic Forwarding Filter and Router filters.
    This issue is resolved in versions 1.34.5 and 1.35.1. To work around this issue, set the     envoy.reloadable_features.dfp_cluster_resolves_hosts runtime flag to false. (CVE-2025-54588)

    Envoy is an open source L7 proxy and communication bus designed for large modern service oriented     architectures. In versions below 1.32.10 and 1.33.0 through 1.33.6, 1.34.0 through 1.34.4 and 1.35.0,     insufficient Session Expiration in the Envoy OAuth2 filter leads to failed logout operations. When     configured with __Secure- or __Host- prefixed cookie names, the filter fails to append the required Secure     attribute to the Set-Cookie header during deletion. Modern browsers ignore this invalid request, causing     the session cookie to persist. This allows a user to remain logged in after they believe they have logged     out, creating a session hijacking risk on shared computers. The current implementation iterates through     the configured cookie names to generate deletion headers but does not check for these prefixes. This     failure to properly construct the deletion header means the user's session cookies are never removed by     the browser, leaving the session active and allowing the next user of the same browser to gain     unauthorized access to the original user's account and data. This is fixed in versions 1.32.10, 1.33.7,     1.34.5 and 1.35.1. (CVE-2025-55162)

    Envoy is a cloud-native, open source edge and service proxy. Prior to 1.36.1, 1.35.5, 1.34.9, and 1.33.10,     large requests and responses can potentially trigger TCP connection pool crashes due to flow control     management in Envoy. It will happen when the connection is closing but upstream data is still coming,     resulting in a buffer watermark callback nullptr reference. The vulnerability impacts TCP proxy and HTTP 1     & 2 mixed use cases based on ALPN. This vulnerability is fixed in 1.36.1, 1.35.5, 1.34.9, and 1.33.10.
    (CVE-2025-62409)

    Envoy is an open source edge and service proxy. Envoy versions earlier than 1.36.2, 1.35.6, 1.34.10, and     1.33.12 contain a use-after-free vulnerability in the Lua filter. When a Lua script executing in the     response phase rewrites a response body so that its size exceeds the configured     per_connection_buffer_limit_bytes (default 1MB), Envoy generates a local reply whose headers override the     original response headers, leaving dangling references and causing a crash. This results in denial of     service. Updating to versions 1.36.2, 1.35.6, 1.34.10, or 1.33.12 fixes the issue. Increasing     per_connection_buffer_limit_bytes (and for HTTP/2 the initial_stream_window_size) or increasing     per_request_buffer_limit_bytes / request_body_buffer_limit can reduce the likelihood of triggering the     condition but does not correct the underlying memory safety flaw. (CVE-2025-62504)

    Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier,     Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allow_missing_or_failed     is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails. This is     caused by a re-entry bug in the JwksFetcherImpl. When the first token's JWKS fetch fails, onJwksError()     callback triggers processing of the second token, which calls fetch() again on the same fetcher object.
    The original callback's reset() then clears the second fetch's state (receiver_ and request_) which causes     a crash when the async HTTP response arrives. (CVE-2025-64527)

    Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier,     when Envoy is configured in TCP proxy mode to handle CONNECT requests, it accepts client data before     issuing a 2xx response and forwards that data to the upstream TCP connection. If a forwarding proxy     upstream from Envoy then responds with a non-2xx status, this can cause a de-synchronized CONNECT tunnel     state. By default Envoy continues to allow early CONNECT data to avoid disrupting existing deployments.
    The envoy.reloadable_features.reject_early_connect_data runtime flag can be set to reject CONNECT requests     that send data before a 2xx response when intermediaries upstream from Envoy may reject establishment of a     CONNECT tunnel. (CVE-2025-64763)

    Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier,     Envoy's mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates     containing an embedded null byte (\0) inside an OTHERNAME SAN value as valid matches. (CVE-2025-66220)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero     copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption     issues. The data sent by the application may be corrupted before transmission over the network thus     leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend     upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791 (CVE-2024-11407)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:1036 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-11407:
    There exists a denial of service through Data corruption in gRPC-C++ -gRPC-C++ servers with transmit     zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption     issues. The data sent by the application may be corrupted before transmission over the network thus     leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend     upgrading past commite9046b2bbebc0cb7f5dc42008f807f6c7e98e791

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:1019 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security Fix(es):

    * python-grpcio: Denial of Service through Data corruption in gRPC-C++ (CVE-2024-11407)

    Users of Red Hat Satellite are advised to upgrade to these updated     packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-819 advisory.

    There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero     copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption     issues. The data sent by the application may be corrupted before transmission over the network thus     leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend     upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791 (CVE-2024-11407)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:0340 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):
    * automation-controller: Potential SQL injection in HasKey(lhs, rhs) on Oracle (CVE-2024-53908)
    * automation-controller: Potential denial-of-service in django.utils.html.strip_tags() (CVE-2024-53907)
    * automation-controller: Denial of Service through Data corruption in gRPC-C++ (CVE-2024-11407)
    * automation-gateway: nanoid mishandles non-integer values (CVE-2024-55565)
    * python3.11-aiohttp: aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions     (CVE-2024-52304)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes included:

    Platform
    * Fixed 'not found' error that occurred occasionally when navigating form wizards (AAP-37495)
    * Fixed an issue where ID_KEY attribute was improperly used to determine the username field in social auth     pipelines (AAP-38300)
    * Fixed an issue where the X-DAB-JW-TOKEN header message would flood logs (AAP-38169)
    * Fixed an issue where authenticator could create a userid and return a non-viable authenticator_uid     (AAP-38021)
    * Enhanced the status API, /api/gateway/v1/status/, from the services property within the JSON to an array     (AAP-37903)
    * Fixes an issue where a private key was displayed in plain text when downloading the OpenAPI schema file.
    NOTE: This was not the private key used by gateway, just a random default key (AAP-37843)

    Automation controller
    * Added 'job_lifecycle' as a choice in loggers to send externally and added 'organization_id' field to     logs related to a job (AAP-37537)
    * Fixed date comparison mismatch for traceback from 'host_metric_summary_monthly' task (AAP-37487)
    * Fixed scheduled jobs with count set to a non-zero value to no longer run unexpectedly (AAP-37290)
    * Fixed the POST operation to '/api/controller/login/' via gateway to no longer result in a fatal error     (AAP-37235)
    * Fixed the behavior of the project's 'requirements.yml' to no longer revert to a prior state in a cluster     (AAP-37228)
    * Fixed occasional error while creating event partition table before starting a job, when lots of jobs are     launched quickly (AAP-37227)
    * Fixed the named URL to no longer return a 404 error code while launching a job template (AAP-37025)
    * Updated receptor to clean up temporary receptor files after a job completes on nodes (AAP-36904)
    * Fixed the POST operation to '/api/controller/login/' via gateway to no longer result in a fatal error     (AAP-33911)
    * automation-controller has been updated to 4.6.6

    Container-based Ansible Automation Platform
    * Fixed an issue where the provided inventory file sample for growth inventories could cause the     installation to stall on low resource systems (AAP-38372)
    * Fixed an issue where the throttle capacity of controller in growth topology installation would allow for     performance degradation (AAP-38207)
    * Fixed an issue where the receptor TLS certificate content was not validated during the preflight role     execution ensuring that the x509 Subject Alt Name (SAN) field contains the required ISO Object Identifier     (OID) (AAP-37880)
    * TLS certificate and key files are now validated during the preflight role execution (AAP-37845)
    * Fixed an issue where the Postgresql SSL mode variables were not validated during the preflight role     execution (AAP-37352)
    * containerized installer setup has been updated to 2.5-8

    RPM-based Ansible Automation Platform
    * Fixed an issue where adding a new automation hub host to upgraded environment has caused the     installation to fail (AAP-38204)
    * Fixed an issue where the link to the documents in the installer README.md was broken (AAP-37627)
    * Updated nginx configuration to properly return API status for Event-Driven Ansible event stream service     (AAP-32816)
    * ansible-automation-platform-installer and installer setup have been updated to 2.5-7

    Additional changes:
    * Installing ansible-core no longer installs python3-jmespath on RHEL 8 (AAP-18251)
    * ansible-core has been updated to 2.16.14-2
    * automation-gateway has been updated to 2.5.20250115
    * python3.11-aiohttp has been updated to 3.10.11 along with its dependencies
    * python3.11-django-ansible-base has been updated to 2.5.20250115
    * python3.11-galaxy-importer has been updated to 0.4.27
    * python3.11-pulpcore has been updated to 3.49.29

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4436-1 advisory.

    - CVE-2024-7246: HPACK table poisoning by gRPC clients communicating with a HTTP/2 proxy. (bsc#1228919)
    - CVE-2024-11407: data corruption on servers with transmit zero copy enabled. (bsc#1233821)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4428-1 advisory.

    - CVE-2024-11407: data corruption on servers with transmit zero copy enabled. (bsc#1233821)
    - CVE-2024-7246: HPACK table poisoning by gRPC clients communicating with a HTTP/2 proxy. (bsc#1228919)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4429-1 advisory.

    - CVE-2024-11407: data corruption on servers with transmit zero copy enabled. (bsc#1233821)
    - CVE-2024-7246: HPACK table poisoning by gRPC clients communicating with a HTTP/2 proxy. (bsc#1228919)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4401-1 advisory.

    - CVE-2024-7246: HPACK table poisoning by gRPC clients communicating with a HTTP/2 proxy. (bsc#1228919)
    - CVE-2024-11407: data corruption on servers with transmit zero copy enabled. (bsc#1233821)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4393-1 advisory.

    - CVE-2024-11407: data corruption on servers with transmit zero copy enabled. (bsc#1233821)
    - CVE-2024-7246: HPACK table poisoning by gRPC clients communicating with a HTTP/2 proxy. (bsc#1228919)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
334047	Photon OS 5.0: Grpc PHSA-2025-5.0-91-0456	Nessus	PhotonOS Local Security Checks	Local	medium
332648	Photon OS 5.0: Grpc PHSA-2025-5.0-92-0456	Nessus	PhotonOS Local Security Checks	Local	medium
282371	Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2025-1357)	Nessus	Amazon Linux Local Security Checks	Local	high
281808	Amazon Linux 2 : ecs-service-connect-agent, --advisory ALAS2ECS-2025-093 (ALASECS-2025-093)	Nessus	Amazon Linux Local Security Checks	Local	high
247113	Linux Distros Unpatched Vulnerability : CVE-2024-11407	Nessus	Misc.	Local	medium
239271	TencentOS Server 4: grpc (TSSA-2024:1036)	Nessus	Tencent Local Security Checks	Local	medium
215064	RHEL 8 / 9 : Satellite 6.16.2 Async Update (Moderate) (RHSA-2025:1019)	Nessus	Red Hat Local Security Checks	Local	medium
214618	Amazon Linux 2023 : grpc, grpc-cpp, grpc-data (ALAS2023-2025-819)	Nessus	Amazon Linux Local Security Checks	Local	medium
214576	Photon OS 5.0: Grpc PHSA-2025-5.0-0456	Nessus	PhotonOS Local Security Checks	Local	medium
214575	Photon OS 4.0: Grpc PHSA-2025-4.0-0739	Nessus	PhotonOS Local Security Checks	Local	medium
214232	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Important) (RHSA-2025:0340)	Nessus	Red Hat Local Security Checks	Local	medium
213459	SUSE SLED15: grpc-devel / grpc-source / libgrpc++1_60 / libgrpc1_60 / libgrpc37 / etc (SUSE-SU-2024:4436-1)	Nessus	SuSE Local Security Checks	Local	medium
213412	SUSE SLES15 Security Update : python-grpcio (SUSE-SU-2024:4428-1)	Nessus	SuSE Local Security Checks	Local	medium
213411	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-grpcio (SUSE-SU-2024:4429-1)	Nessus	SuSE Local Security Checks	Local	medium
213310	SUSE SLED15: grpc-devel / grpc-source / libgrpc++1_60 / libgrpc1_60 / libgrpc37 / etc (SUSE-SU-2024:4401-1)	Nessus	SuSE Local Security Checks	Local	medium
213308	SUSE SLES15 / openSUSE 15 Security Update : python-grpcio (SUSE-SU-2024:4393-1)	Nessus	SuSE Local Security Checks	Local	medium

Detections

Analytics

CVE-2024-11407

medium

Tenable Plugins

medium

medium

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium