When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool,curl should check the public key of the server certificate to verify the peer. This check was skipped in a certain condition that would then make curl allow the connection without performing the proper check, thus not noticing a possible impostor. To skip this check, the connection had to be done with QUIC with ngtcp2 built to use GnuTLS and the user had to explicitly disable the standard certificate verification.

An update of the curl package has been released.

The version of Tenable Identity Exposure running on the remote host is prior to 3.93.5. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2026-16:

  - Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose     sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user     accounts, and directory settings to unauthenticated remote attackers. Affected responses are served with     Cache-Control: public headers and without Vary: Cookie, allowing reverse proxies and CDNs to cache and     serve sensitive data to unauthenticated users even after authentication is applied. (CVE-2026-13007)

  - Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows     an authorized attacker to bypass a security feature over a network. (CVE-2025-55315)

  - Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer     overflow on 32 bit platforms. A heap buffer overflow may lead to a crash or possibly an attacker     controlled code execution or other undefined behavior. (CVE-2026-31789)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.5.4. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-14 advisory.

  - An integer overflow can be triggered in SQLite's `concat_ws()` function. The resulting, truncated integer     is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the     original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can     result in arbitrary code execution. (CVE-2025-3277)

  - When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool,curl     should check the public key of the server certificate to verify the peer. This check was skipped in a     certain condition that would then make curl allow the connection without performing the proper check, thus     not noticing a possible impostor. To skip this check, the connection had to be done with QUIC with ngtcp2     built to use GnuTLS and the user had to explicitly disable the standard certificate verification.
    (CVE-2025-13034)

  - When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread     would inadvertently change them globally and therefore possibly also affect other concurrently setup     transfers. Disabling certificate verification for a specific transfer could unintentionally disable the     feature for other threads as well. (CVE-2025-14017)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of HTTP Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2026 CPU advisory.

  - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported     versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. While the     vulnerability is in Oracle HTTP Server, attacks may significantly impact additional products (scope     change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or     modification access to critical data or all Oracle HTTP Server accessible data as well as unauthorized     access to critical data or complete access to all Oracle HTTP Server accessible data. (CVE-2026-34291)

  - Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi)     passes the shell-escaped query string to #exec cmd=... directives. This issue affects Apache HTTP Server     before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue. (CVE-2025-58098)

  - Server-Side Request Forgery (SSRF) in Apache HTTP Server on Windows allows to potentially leak NTLM hashes     to a malicious server via mod_rewrite or apache expressions that pass unvalidated request input. This issue     affects Apache HTTP Server: from 2.4.0 through 2.4.63. Note: The Apache HTTP Server Project will be setting     a higher bar for accepting vulnerability reports regarding SSRF via UNC paths. The server offers limited     protection against administrators directing the server to open UNC paths. Windows servers should limit the     hosts they will connect over via SMB based on the nature of NTLM authentication. (CVE-2024-43394)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 086d53fa-1d47-11f1-81da-8447094a420f advisory.

    The curl project reports:
    Multiple vulnerabilities

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8062-1 advisory.

    It was discovered that curl incorrectly handled cookies when redirected from secure to insecure     connections. An attacker could possibly use this issue to cause a denial of service, or obtain sensitive     information. This issue only affected Ubuntu 25.10. (CVE-2025-9086)

    Calvin Ruocco discovered that curl did not properly handle WebSocket communications under certain     circumstances. A malicious server could possibly use this issue to poison proxy caches with malicious     content. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-10148)

    Stanislav Fort discovered that wcurl did not properly handle URLs with certain encoded characters. If a     user were tricked into processing a specially crafted URL, an attacker could possibly use this issue to     write files outside the intended directory. This issue only affected Ubuntu 25.10. (CVE-2025-11563)

    Stanislav Fort discovered that curl did not properly validate pinned public keys under certain     circumstances. A remote attacker could possibly use this issue to perform a machine-in-the-middle attack.
    This issue only affected Ubuntu 25.10.(CVE-2025-13034)

    Stanislav Fort discovered that curl did not properly manage TLS options when performing LDAP over TLS     transfers in multi-threaded environments. Under certain circumstances, certificate verification could be     unintentionally and unknowingly disabled. (CVE-2025-14017)

    It was discovered that curl incorrectly handled Oauth2 bearer tokens when following redirects. A remote     attacker could possibly use this issue to obtain authentication credentials. (CVE-2025-14524)

    Stanislav Fort discovered that curl did not properly validate TLS certificates when reusing connections. A     remote attacker could possibly use this issue to bypass expected certificate verification. This issue only     affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-14819)

    Harry Sintonen discovered that curl did not properly validate SSH host keys when performing SSH-based file     transfers. This issue could lead to unintended bypass of custom known_hosts file. This issue only affected     Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-15079)

    Harry Sintonen discovered that curl built with libssh did not properly handle authentication when     performing SSH-based file transfers. This could result in unintended authentication operations. This issue     only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-15224)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable Security Center running on the remote host prior or equal to 6.7.2 and missing relevant patches. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-06 advisory.

  - In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.*     before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays     exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts     using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and     availability of the target server. (CVE-2025-14178)

  - In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.*     before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid     character sequence (such as \x99) in a prepared statement parameter may cause the quoting function     PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function.
    This may lead to crashes (segmentation fault) and affect the availability of the target server.
    (CVE-2025-14180)

  - When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol     redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the     bearer token to the new target host. (CVE-2025-14524)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1375 advisory.

    No QUIC certificate pinning with GnuTLS

    NOTE: https://curl.se/docs/CVE-2025-13034.htmlNOTE: Introduced with:
    https://github.com/curl/curl/commit/3210101088dfa3d6a125d213226b092f2f866722 (curl-8_8_0)NOTE: Fixed by:
    https://github.com/curl/curl/commit/3d91ca8cdb3b434226e743946d428b4dd3acf2c9 (rc-8_18_0-1, curl-8_18_0)     (CVE-2025-13034)

    broken TLS options for threaded LDAPS

    NOTE: https://curl.se/docs/CVE-2025-14017.htmlNOTE: Introduced with:
    https://github.com/curl/curl/commit/ccba0d10b6baf5c73cae8cf4fb3f29f0f55c5a34 (curl-7_17_0)NOTE: Fixed by:
    https://github.com/curl/curl/commit/39d1976b7f709a516e3243338ebc0443bdd8d56d (rc-8_18_0-1,     curl-8_18_0)NOTE: Built with OpenLDAP (only affects the legacy LDAP support) (CVE-2025-14017)

    bearer token leak on cross-protocol redirect

    NOTE: https://curl.se/docs/CVE-2025-14524.htmlNOTE: Introduced with:
    https://github.com/curl/curl/commit/06c1bea72faabb6fad4b7ef818aafaa336c9a7aa (curl-7_33_0)NOTE: Fixed by:
    https://github.com/curl/curl/commit/1a822275d333dc6da6043497160fd04c8fa48640 (rc-8_18_0-2, curl-8_18_0)     (CVE-2025-14524)

    OpenSSL partial chain store policy bypass

    NOTE: https://curl.se/docs/CVE-2025-14819.htmlNOTE: Introduced with:
    https://github.com/curl/curl/commit/3c16697ebd796f799227be293e8689aec5f8190d (curl-7_87_0)NOTE: Fixed by:
    https://github.com/curl/curl/commit/cd046f6c93b39d673a58c18648d8906e954c4f5d (rc-8_18_0-3, curl-8_18_0)     (CVE-2025-14819)

    libssh global knownhost override

    NOTE: https://curl.se/docs/CVE-2025-15079.htmlNOTE: Introduced with:
    https://github.com/curl/curl/commit/c92d2e14cfb0db662f958effd2ac86f995cf1b5a (curl-7_58_0)NOTE: Fixed by:
    https://github.com/curl/curl/commit/adca486c125d9a6d9565b9607a19dce803a8b479 (rc-8_18_0-3,     curl-8_18_0)NOTE: Debian builds with libssh2 for SSH backend (CVE-2025-15079)

    libssh key passphrase bypass without agent set

    NOTE: https://curl.se/docs/CVE-2025-15224.htmlNOTE: Introduced with:
    https://github.com/curl/curl/commit/c92d2e14cfb0db662f958effd2ac86f995cf1b5a (curl-7_58_0)NOTE: Fixed by:
    https://github.com/curl/curl/commit/16d5f2a5660c61cc27bd5f1c7f512391d1c927aa (curl-8_18_0)NOTE: Debian     builds with libssh2 for SSH backend (CVE-2025-15224)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.5.3. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-02 advisory.

  - A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects     the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest     Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix     this issue. The associated identifier of this vulnerability is VDB-248999. (CVE-2023-7104)

  - A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under     certain circumstances when the XML schematron has the <sch:name path=.../> schema elements. This flaw     allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the     program's crash using libxml or other possible undefined behaviors. (CVE-2025-49794)

  - A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can     trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that     can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to     sensitive data being corrupted in memory. (CVE-2025-49796)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of curl installed on the remote host is missing a security update. It is, therefore, affected by an improper certificate validation vulnerability.

  - When using the CURLOPT_PINNEDPUBLICKEY option with libcurl or --pinnedpubkey with the curl tool,     the public key check should be performed to verify the server certificate peer.     However, this check is skipped if the connection uses QUIC with ngtcp2 built against GnuTLS and     the user has explicitly disabled standard certificate verification. This could allow     a connection to an impostor server without the intended public key verification.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of curl installed on the remote host is prior to 8.17.0 / 8.18.0. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-007-01 advisory.

    New curl packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the curl security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool,curl     should check the public key of the server certificate to verify the peer. This check was skipped in a     certain condition that would then make curl allow the connection without performing the proper check, thus     not noticing a possible impostor. To skip this check, the connection had to be done with QUIC with ngtcp2     built to use GnuTLS and the user had to explicitly disable the standard certificate verification.
    (CVE-2025-13034)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
333785	Photon OS 5.0: Curl PHSA-2026-5.0-91-0732	Nessus	PhotonOS Local Security Checks	Local	medium
322483	Tenable Identity Exposure < 3.93.5 Multiple Vulnerabilities (TNS-2026-16)	Nessus	Misc.	Combined	high
314931	Nessus Network Monitor < 6.5.4 Multiple Vulnerabilities (TNS-2026-14)	Nessus	Misc.	Local	medium
309969	Oracle HTTP Server (April 2026 CPU)	Nessus	Web Servers	Local	high
309968	Oracle HTTP Server (April 2026 CPU)	Nessus	Web Servers	Local	high
301883	FreeBSD : curl -- Multiple vulnerabilities (086d53fa-1d47-11f1-81da-8447094a420f)	Nessus	FreeBSD Local Security Checks	Local	medium
300431	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 : curl vulnerabilities (USN-8062-1)	Nessus	Ubuntu Local Security Checks	Local	medium
299667	Tenable Security Center Multiple Vulnerabilities (TNS-2026-06)	Nessus	Misc.	Combined	high
299563	Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2026-1375)	Nessus	Amazon Linux Local Security Checks	Local	medium
297245	Photon OS 4.0: Curl PHSA-2026-4.0-0941	Nessus	PhotonOS Local Security Checks	Local	medium
297102	Nessus Network Monitor < 6.5.3 Multiple Vulnerabilities (TNS-2026-02)	Nessus	Misc.	Local	high
291358	Curl 8.8.0 < 8.18.0 Improper Certificate Validation.	Nessus	Misc.	Local	medium
282640	Photon OS 5.0: Curl PHSA-2026-5.0-0732	Nessus	PhotonOS Local Security Checks	Local	medium
282347	Slackware Linux 15.0 / current curl Multiple Vulnerabilities (SSA:2026-007-01)	Nessus	Slackware Local Security Checks	Local	medium
282310	Linux Distros Unpatched Vulnerability : CVE-2025-13034	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2025-13034

medium

Tenable Plugins

medium

high

medium

high

high

medium

medium

high

medium

medium

high

medium

medium

medium

medium