When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file.

tenable TNS-2026-06: [R2] Stand-alone Security Patches Available for Tenable Security Center versions 6.5.1, 6.6.0 and 6.7.2: SC-202602.1 + SC-202602.2

According to its self-reported version, the Tenable Security Center running on the remote host prior or equal to 6.7.2 and missing relevant patches. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-06 advisory.

  - In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.*     before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays     exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts     using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and     availability of the target server. (CVE-2025-14178)

  - In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.*     before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid     character sequence (such as \x99) in a prepared statement parameter may cause the quoting function     PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function.
    This may lead to crashes (segmentation fault) and affect the availability of the target server.
    (CVE-2025-14180)

  - When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol     redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the     bearer token to the new target host. (CVE-2025-14524)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1375 advisory.

    No QUIC certificate pinning with GnuTLS

    NOTE: https://curl.se/docs/CVE-2025-13034.htmlNOTE: Introduced with:
    https://github.com/curl/curl/commit/3210101088dfa3d6a125d213226b092f2f866722 (curl-8_8_0)NOTE: Fixed by:
    https://github.com/curl/curl/commit/3d91ca8cdb3b434226e743946d428b4dd3acf2c9 (rc-8_18_0-1, curl-8_18_0)     (CVE-2025-13034)

    broken TLS options for threaded LDAPS

    NOTE: https://curl.se/docs/CVE-2025-14017.htmlNOTE: Introduced with:
    https://github.com/curl/curl/commit/ccba0d10b6baf5c73cae8cf4fb3f29f0f55c5a34 (curl-7_17_0)NOTE: Fixed by:
    https://github.com/curl/curl/commit/39d1976b7f709a516e3243338ebc0443bdd8d56d (rc-8_18_0-1,     curl-8_18_0)NOTE: Built with OpenLDAP (only affects the legacy LDAP support) (CVE-2025-14017)

    bearer token leak on cross-protocol redirect

    NOTE: https://curl.se/docs/CVE-2025-14524.htmlNOTE: Introduced with:
    https://github.com/curl/curl/commit/06c1bea72faabb6fad4b7ef818aafaa336c9a7aa (curl-7_33_0)NOTE: Fixed by:
    https://github.com/curl/curl/commit/1a822275d333dc6da6043497160fd04c8fa48640 (rc-8_18_0-2, curl-8_18_0)     (CVE-2025-14524)

    OpenSSL partial chain store policy bypass

    NOTE: https://curl.se/docs/CVE-2025-14819.htmlNOTE: Introduced with:
    https://github.com/curl/curl/commit/3c16697ebd796f799227be293e8689aec5f8190d (curl-7_87_0)NOTE: Fixed by:
    https://github.com/curl/curl/commit/cd046f6c93b39d673a58c18648d8906e954c4f5d (rc-8_18_0-3, curl-8_18_0)     (CVE-2025-14819)

    libssh global knownhost override

    NOTE: https://curl.se/docs/CVE-2025-15079.htmlNOTE: Introduced with:
    https://github.com/curl/curl/commit/c92d2e14cfb0db662f958effd2ac86f995cf1b5a (curl-7_58_0)NOTE: Fixed by:
    https://github.com/curl/curl/commit/adca486c125d9a6d9565b9607a19dce803a8b479 (rc-8_18_0-3,     curl-8_18_0)NOTE: Debian builds with libssh2 for SSH backend (CVE-2025-15079)

    libssh key passphrase bypass without agent set

    NOTE: https://curl.se/docs/CVE-2025-15224.htmlNOTE: Introduced with:
    https://github.com/curl/curl/commit/c92d2e14cfb0db662f958effd2ac86f995cf1b5a (curl-7_58_0)NOTE: Fixed by:
    https://github.com/curl/curl/commit/16d5f2a5660c61cc27bd5f1c7f512391d1c927aa (curl-8_18_0)NOTE: Debian     builds with libssh2 for SSH backend (CVE-2025-15224)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of curl installed on the remote host is prior to 8.3.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3173 advisory.

    curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed     and missed host verification mechanisms.

    This prevents curl from detecting MITM attackers and more. (CVE-2025-10966)

    broken TLS options for threaded LDAPS

    NOTE: https://curl.se/docs/CVE-2025-14017.htmlNOTE: Introduced with:
    https://github.com/curl/curl/commit/ccba0d10b6baf5c73cae8cf4fb3f29f0f55c5a34 (curl-7_17_0)NOTE: Fixed by:
    https://github.com/curl/curl/commit/39d1976b7f709a516e3243338ebc0443bdd8d56d (rc-8_18_0-1,     curl-8_18_0)NOTE: Built with OpenLDAP (only affects the legacy LDAP support) (CVE-2025-14017)

    bearer token leak on cross-protocol redirect

    NOTE: https://curl.se/docs/CVE-2025-14524.htmlNOTE: Introduced with:
    https://github.com/curl/curl/commit/06c1bea72faabb6fad4b7ef818aafaa336c9a7aa (curl-7_33_0)NOTE: Fixed by:
    https://github.com/curl/curl/commit/1a822275d333dc6da6043497160fd04c8fa48640 (rc-8_18_0-2, curl-8_18_0)     (CVE-2025-14524)

    OpenSSL partial chain store policy bypass

    NOTE: https://curl.se/docs/CVE-2025-14819.htmlNOTE: Introduced with:
    https://github.com/curl/curl/commit/3c16697ebd796f799227be293e8689aec5f8190d (curl-7_87_0)NOTE: Fixed by:
    https://github.com/curl/curl/commit/cd046f6c93b39d673a58c18648d8906e954c4f5d (rc-8_18_0-3, curl-8_18_0)     (CVE-2025-14819)

    libssh global knownhost override

    NOTE: https://curl.se/docs/CVE-2025-15079.htmlNOTE: Introduced with:
    https://github.com/curl/curl/commit/c92d2e14cfb0db662f958effd2ac86f995cf1b5a (curl-7_58_0)NOTE: Fixed by:
    https://github.com/curl/curl/commit/adca486c125d9a6d9565b9607a19dce803a8b479 (rc-8_18_0-3,     curl-8_18_0)NOTE: Debian builds with libssh2 for SSH backend (CVE-2025-15079)

    libssh key passphrase bypass without agent set

    NOTE: https://curl.se/docs/CVE-2025-15224.htmlNOTE: Introduced with:
    https://github.com/curl/curl/commit/c92d2e14cfb0db662f958effd2ac86f995cf1b5a (curl-7_58_0)NOTE: Fixed by:
    https://github.com/curl/curl/commit/16d5f2a5660c61cc27bd5f1c7f512391d1c927aa (curl-8_18_0)NOTE: Debian     builds with libssh2 for SSH backend (CVE-2025-15224)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the curl package has been released.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.5.3. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-02 advisory.

  - A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects     the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest     Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix     this issue. The associated identifier of this vulnerability is VDB-248999. (CVE-2023-7104)

  - A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under     certain circumstances when the XML schematron has the <sch:name path=.../> schema elements. This flaw     allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the     program's crash using libxml or other possible undefined behaviors. (CVE-2025-49794)

  - A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can     trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that     can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to     sensitive data being corrupted in memory. (CVE-2025-49796)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004931 advisory.

    When doing SSH-based transfers using either SCP or SFTP, and setting the     known_hosts file, libcurl could still mistakenly accept connecting to hosts
    *not present* in the specified file if they were added as recognized in the     libssh *global* known_hosts file.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of curl installed on the remote host is 7.58 <= 8.17.0. It is, therefore, affected by multiple vulnerabilities when built with the libssh backend:

- A key passphrase bypass vulnerability exists where curl wrongly authenticates using a locally   running SSH agent even when specifically asked to perform public key authentication.   (CVE-2025-15224)

- A global known_hosts override vulnerability exists where libcurl may mistakenly accept connections   to hosts not present in a specified known_hosts file if they are recognized in the libssh global   known_hosts file. (CVE-2025-15079)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20031-1 advisory.

    This update for curl fixes the following issues:

    - CVE-2025-14017: broken TLS options for threaded LDAPS (bsc#1256105).
    - CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
    - CVE-2025-14819: libssh global knownhost override (bsc#1255732).
    - CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
    - CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0066-1 advisory.

    - CVE-2025-14524: Fixed bearer token leak on cross-protocol redirect (bsc#1255731)
      - CVE-2025-15079: Fixed unknown host connection acceptance when set in the global knownhostsfile     (bsc#1255733)
      - CVE-2025-14819: Fixed issue where alteration of CURLSSLOPT_NO_PARTIALCHAIN could       accidentally lead to CA cache reuse for which partial chain was reversed (bsc#1255732)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0052-1 advisory.

    - CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
    - CVE-2025-14819: libssh global knownhost override (bsc#1255732).
    - CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
    - CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0050-1 advisory.

    - CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
    - CVE-2025-14819: libssh global knownhost override (bsc#1255732).
    - CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
    - CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could     still mistakenly accept connecting to hosts *not present* in the specified file if they were added as     recognized in the libssh *global* known_hosts file. (CVE-2025-15079)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
299667	Tenable Security Center Multiple Vulnerabilities (TNS-2026-06)	Nessus	Misc.	high
299563	Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2026-1375)	Nessus	Amazon Linux Local Security Checks	medium
299549	Amazon Linux 2 : curl, --advisory ALAS2-2026-3173 (ALAS-2026-3173)	Nessus	Amazon Linux Local Security Checks	medium
297245	Photon OS 4.0: Curl PHSA-2026-4.0-0941	Nessus	PhotonOS Local Security Checks	medium
297102	Nessus Network Monitor < 6.5.3 Multiple Vulnerabilities (TNS-2026-02)	Nessus	Misc.	high
296377	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: curl (UTSA-2026-004931)	Nessus	Unity Linux Local Security Checks	medium
291361	Curl 7.58.0 < 8.18.0 Multiple Vulnerabilities	Nessus	Misc.	medium
287974	openSUSE 16 Security Update : curl (openSUSE-SU-2026:20031-1)	Nessus	SuSE Local Security Checks	medium
282640	Photon OS 5.0: Curl PHSA-2026-5.0-0732	Nessus	PhotonOS Local Security Checks	medium
282494	SUSE SLES12 Security Update : curl (SUSE-SU-2026:0066-1)	Nessus	SuSE Local Security Checks	medium
282450	SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2026:0052-1)	Nessus	SuSE Local Security Checks	medium
282448	openSUSE 15 Security Update : curl (SUSE-SU-2026:0050-1)	Nessus	SuSE Local Security Checks	medium
282308	Linux Distros Unpatched Vulnerability : CVE-2025-15079	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-15079

medium

Tenable Plugins

Coming Soon

high

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium