When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.

An update of the curl package has been released.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.5.3. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-02 advisory.

  - A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects     the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest     Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix     this issue. The associated identifier of this vulnerability is VDB-248999. (CVE-2023-7104)

  - A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under     certain circumstances when the XML schematron has the <sch:name path=.../> schema elements. This flaw     allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the     program's crash using libxml or other possible undefined behaviors. (CVE-2025-49794)

  - A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can     trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that     can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to     sensitive data being corrupted in memory. (CVE-2025-49796)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3f0f0f85be advisory.

    - fix broken TLS options for threaded LDAPS (CVE-2025-14017)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004936 advisory.

    When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,     changing TLS options in one thread would inadvertently change them globally     and therefore possibly also affect other concurrently setup transfers.

    Disabling certificate verification for a specific transfer could     unintentionally disable the feature for other threads as well.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0221-1 advisory.

    - CVE-2025-14017: Fixed broken TLS options for threaded LDAPS (bsc#1256105).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004928 advisory.

    When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,     changing TLS options in one thread would inadvertently change them globally     and therefore possibly also affect other concurrently setup transfers.

    Disabling certificate verification for a specific transfer could     unintentionally disable the feature for other threads as well.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e27b23af78 advisory.

    - fix broken TLS options for threaded LDAPS (CVE-2025-14017)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of libcurl installed on the remote host is missing a security update. It is, therefore, affected by a security bypass vulnerability in multi-threaded LDAPS transfers.

  - When performing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options     in one thread could inadvertently change them globally. This may affect other     concurrently setup transfers; for example, disabling certificate verification for a specific     transfer could unintentionally disable the feature for other threads as well.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20031-1 advisory.

    This update for curl fixes the following issues:

    - CVE-2025-14017: broken TLS options for threaded LDAPS (bsc#1256105).
    - CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
    - CVE-2025-14819: libssh global knownhost override (bsc#1255732).
    - CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
    - CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:0119-1 advisory.

    - CVE-2025-14017: Fixed broken TLS options for threaded LDAPS (bsc#1256105)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:0077-1 advisory.

    - CVE-2025-14017: Fixed broken TLS options for threaded LDAPS (bsc#1256105).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread     would inadvertently change them globally and therefore possibly also affect other concurrently setup     transfers. Disabling certificate verification for a specific transfer could unintentionally disable the     feature for other threads as well. (CVE-2025-14017)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
297245	Photon OS 4.0: Curl PHSA-2026-4.0-0941	Nessus	PhotonOS Local Security Checks	medium
297102	Nessus Network Monitor < 6.5.3 Multiple Vulnerabilities (TNS-2026-02)	Nessus	Misc.	high
296985	Fedora 42 : curl (2026-3f0f0f85be)	Nessus	Fedora Local Security Checks	medium
296506	Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: curl (UTSA-2026-004936)	Nessus	Unity Linux Local Security Checks	medium
296459	SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2026:0221-1)	Nessus	SuSE Local Security Checks	medium
296373	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: curl (UTSA-2026-004928)	Nessus	Unity Linux Local Security Checks	medium
294949	Fedora 43 : curl (2026-e27b23af78)	Nessus	Fedora Local Security Checks	medium
291360	libcurl 7.17.0 < 8.18.0 Security Bypass.	Nessus	Misc.	medium
287974	openSUSE 16 Security Update : curl (openSUSE-SU-2026:20031-1)	Nessus	SuSE Local Security Checks	medium
284806	SUSE SLES12 Security Update : curl (SUSE-SU-2026:0119-1)	Nessus	SuSE Local Security Checks	medium
282640	Photon OS 5.0: Curl PHSA-2026-5.0-0732	Nessus	PhotonOS Local Security Checks	medium
282546	openSUSE 15 Security Update : curl (SUSE-SU-2026:0077-1)	Nessus	SuSE Local Security Checks	medium
282309	Linux Distros Unpatched Vulnerability : CVE-2025-14017	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-14017

medium

Tenable Plugins

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium