curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.

tenable TNS-2026-02: [R1] Tenable Network Monitor Version 6.5.3 Fixes Multiple Vulnerabilities

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004937 advisory.

    curl's code for managing SSH connections when SFTP was done using the wolfSSH     powered backend was flawed and missed host verification mechanisms.

    This prevents curl from detecting MITM attackers and more.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004933 advisory.

    curl's code for managing SSH connections when SFTP was done using the wolfSSH     powered backend was flawed and missed host verification mechanisms.

    This prevents curl from detecting MITM attackers and more.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    curl's code for managing SSH connections when SFTP was done using the wolfSSH     powered backend was flawed and missed host verification mechanisms.

    This prevents curl from detecting MITM attackers and more.(CVE-2025-10966)

Tenable has extracted the preceding description block directly from the EulerOS curl security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the curl package has been released.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1351 advisory.

    When asked to both use a `.netrc` file for credentials and to follow HTTPredirects, curl could leak the     password used for the first host to thefollowed-to host under certain circumstances.

    This flaw only manifests itself if the netrc file has an entry that matchesthe redirect target hostname     but the entry either omits just the password oromits both login and password. (CVE-2024-11053)

    When asked to use a `.netrc` file for credentials **and** to follow HTTPredirects, curl could leak the     password used for the first host to thefollowed-to host under certain circumstances.

    This flaw only manifests itself if the netrc file has a `default` entry thatomits both login and password.
    A rare circumstance. (CVE-2025-0167)

    predictable WebSocket mask

    NOTE: https://curl.se/docs/CVE-2025-10148.htmlNOTE: Fixed by:
    https://github.com/curl/curl/commit/84db7a9eae8468c0445b15aa806fa7fa806fa0f2 (curl-8_16_0)     (CVE-2025-10148)

    curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed     and missed host verification mechanisms.

    This prevents curl from detecting MITM attackers and more. (CVE-2025-10966)

    Out of bounds read for cookie path

    NOTE: https://curl.se/docs/CVE-2025-9086.htmlNOTE: Introduced with:
    https://github.com/curl/curl/commit/f24dc09d209a2f91ca38d854f0c15ad93f3d7e2d (curl-7_31_0)NOTE: Fixed by:
    https://github.com/curl/curl/commit/c6ae07c6a541e0e96d0040afb62b45dd37711300 (rc-8_16_0-1) (CVE-2025-9086)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed     and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.
    (CVE-2025-10966)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
296507	Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: curl (UTSA-2026-004937)	Nessus	Unity Linux Local Security Checks	medium
296374	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: curl (UTSA-2026-004933)	Nessus	Unity Linux Local Security Checks	medium
284766	EulerOS 2.0 SP12 : curl (EulerOS-SA-2026-1066)	Nessus	Huawei Local Security Checks	medium
284743	EulerOS 2.0 SP10 : curl (EulerOS-SA-2026-1023)	Nessus	Huawei Local Security Checks	medium
284742	EulerOS 2.0 SP12 : curl (EulerOS-SA-2026-1086)	Nessus	Huawei Local Security Checks	medium
284723	EulerOS 2.0 SP10 : curl (EulerOS-SA-2026-1044)	Nessus	Huawei Local Security Checks	medium
282640	Photon OS 5.0: Curl PHSA-2026-5.0-0732	Nessus	PhotonOS Local Security Checks	medium
282370	Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2025-1351)	Nessus	Amazon Linux Local Security Checks	medium
272312	Linux Distros Unpatched Vulnerability : CVE-2025-10966	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-10966

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium

medium

medium

medium

medium