curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    curl's code for managing SSH connections when SFTP was done using the wolfSSH     powered backend was flawed and missed host verification mechanisms.

    This prevents curl from detecting MITM attackers and more.(CVE-2025-10966)

Tenable has extracted the preceding description block directly from the EulerOS curl security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    curl's code for managing SSH connections when SFTP was done using the wolfSSH     powered backend was flawed and missed host verification mechanisms.

    This prevents curl from detecting MITM attackers and more.(CVE-2025-10966)

    When libcurl is asked to perform automatic gzip decompression of     content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,
    **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would     make libcurl perform a buffer overflow.(CVE-2025-0725)

    1. A cookie is set using the `secure` keyword for `https://target`     2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear     text HTTP) using the same cookie set     3. The same cookie name is set - but with just a slash as path (`path='/'`).Since this site is not secure,     the cookie *should* just be ignored.
    4. A bug in the path comparison logic makes curl read outside a heap buffer boundary

    The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets     the clear-text site override the contents of the secure cookie, contrary to expectations and depending on     the memory contents immediately following the single-byte allocation that holds the path.

    The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was     already set as secure on a secure host so overriding it on an insecure host should not be     okay.(CVE-2025-9086)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization curl security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the curl package has been released.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.5.3. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-02 advisory.

  - A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects     the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest     Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix     this issue. The associated identifier of this vulnerability is VDB-248999. (CVE-2023-7104)

  - A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under     certain circumstances when the XML schematron has the <sch:name path=.../> schema elements. This flaw     allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the     program's crash using libxml or other possible undefined behaviors. (CVE-2025-49794)

  - A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can     trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that     can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to     sensitive data being corrupted in memory. (CVE-2025-49796)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004937 advisory.

    curl's code for managing SSH connections when SFTP was done using the wolfSSH     powered backend was flawed and missed host verification mechanisms.

    This prevents curl from detecting MITM attackers and more.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004933 advisory.

    curl's code for managing SSH connections when SFTP was done using the wolfSSH     powered backend was flawed and missed host verification mechanisms.

    This prevents curl from detecting MITM attackers and more.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1351 advisory.

    When asked to both use a `.netrc` file for credentials and to follow HTTPredirects, curl could leak the     password used for the first host to thefollowed-to host under certain circumstances.

    This flaw only manifests itself if the netrc file has an entry that matchesthe redirect target hostname     but the entry either omits just the password oromits both login and password. (CVE-2024-11053)

    When asked to use a `.netrc` file for credentials **and** to follow HTTPredirects, curl could leak the     password used for the first host to thefollowed-to host under certain circumstances.

    This flaw only manifests itself if the netrc file has a `default` entry thatomits both login and password.
    A rare circumstance. (CVE-2025-0167)

    predictable WebSocket mask

    NOTE: https://curl.se/docs/CVE-2025-10148.htmlNOTE: Fixed by:
    https://github.com/curl/curl/commit/84db7a9eae8468c0445b15aa806fa7fa806fa0f2 (curl-8_16_0)     (CVE-2025-10148)

    curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed     and missed host verification mechanisms.

    This prevents curl from detecting MITM attackers and more. (CVE-2025-10966)

    Out of bounds read for cookie path

    NOTE: https://curl.se/docs/CVE-2025-9086.htmlNOTE: Introduced with:
    https://github.com/curl/curl/commit/f24dc09d209a2f91ca38d854f0c15ad93f3d7e2d (curl-7_31_0)NOTE: Fixed by:
    https://github.com/curl/curl/commit/c6ae07c6a541e0e96d0040afb62b45dd37711300 (rc-8_16_0-1) (CVE-2025-9086)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed     and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.
    (CVE-2025-10966)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
297601	EulerOS 2.0 SP13 : curl (EulerOS-SA-2026-1219)	Nessus	Huawei Local Security Checks	medium
297597	EulerOS 2.0 SP13 : curl (EulerOS-SA-2026-1207)	Nessus	Huawei Local Security Checks	medium
297366	EulerOS Virtualization 2.10.0 : curl (EulerOS-SA-2026-1160)	Nessus	Huawei Local Security Checks	high
297359	EulerOS Virtualization 2.10.1 : curl (EulerOS-SA-2026-1109)	Nessus	Huawei Local Security Checks	high
297245	Photon OS 4.0: Curl PHSA-2026-4.0-0941	Nessus	PhotonOS Local Security Checks	medium
297102	Nessus Network Monitor < 6.5.3 Multiple Vulnerabilities (TNS-2026-02)	Nessus	Misc.	high
296507	Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: curl (UTSA-2026-004937)	Nessus	Unity Linux Local Security Checks	medium
296374	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: curl (UTSA-2026-004933)	Nessus	Unity Linux Local Security Checks	medium
284766	EulerOS 2.0 SP12 : curl (EulerOS-SA-2026-1066)	Nessus	Huawei Local Security Checks	medium
284743	EulerOS 2.0 SP10 : curl (EulerOS-SA-2026-1023)	Nessus	Huawei Local Security Checks	medium
284742	EulerOS 2.0 SP12 : curl (EulerOS-SA-2026-1086)	Nessus	Huawei Local Security Checks	medium
284723	EulerOS 2.0 SP10 : curl (EulerOS-SA-2026-1044)	Nessus	Huawei Local Security Checks	medium
282640	Photon OS 5.0: Curl PHSA-2026-5.0-0732	Nessus	PhotonOS Local Security Checks	medium
282370	Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2025-1351)	Nessus	Amazon Linux Local Security Checks	medium
272312	Linux Distros Unpatched Vulnerability : CVE-2025-10966	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-10966

medium

Tenable Plugins

medium

medium

high

high

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium