Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary.

Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address.  Impact summary: An out- of-bounds read can trigger a crash which leads to Denial of Service for an application.  The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker.  In this vulnerable code the out of bounds read can only trigger a crash.
Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity.  The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.  The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

An update of the openssl package has been released.

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Docker Images (SQLite)). Supported     versions that are affected are 8.4.0-8.4.7. Easily exploitable vulnerability allows unauthenticated attacker with     network access via MySQL Protocol to compromise MySQL Server. Successful attacks of this vulnerability can result in     takeover of MySQL Server. (CVE-2025-6965)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging). Supported versions that are     affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via MySQL Protocol to compromise MySQL Server. Successful attacks of this vulnerability can result     in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2025-9230)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are     affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker     with network access via MySQL Protocol to compromise MySQL Server. Successful attacks of this vulnerability can result     in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2026-21968)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging). Supported versions that are     affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via MySQL Protocol to compromise MySQL Server. Successful attacks of this vulnerability can result     in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2025-9230)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are     affected are 9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via MySQL     Protocol to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2026-21949)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are     affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker     with network access via MySQL Protocol to compromise MySQL Server. Successful attacks of this vulnerability can result     in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2026-21968)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging). Supported versions that are     affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via MySQL Protocol to compromise MySQL Server. Successful attacks of this vulnerability can result     in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2025-9230)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are     affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker     with network access via MySQL Protocol to compromise MySQL Server. Successful attacks of this vulnerability can result     in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2026-21968)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are     8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Vulnerable component is not exploitable without authentication. (CVE-2026-21936)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 7.6.0.0.0 and 8.2.0.0.0 versions of Oracle Business Intelligence Publisher installed on the remote host are affected by a vulnerability as referenced in the January 2026 CPU advisory.

  - Security-in-Depth issue in the Oracle BI Publisher product of Oracle Analytics (component: Development     Operations (Apache Tomcat)). The Spring Framework annotation detection mechanism may not correctly resolve annotations     on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such     annotations are used for authorization decisions. Your application may be affected by this if you are using Spring     Security's @EnableMethodSecurity feature. (CVE-2025-41249)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - Vulnerability in the Oracle Spatial and Graph (OpenJPEG) component of Oracle Database Server. Supported     versions that are affected are 23.4.0-23.26.0. Easily exploitable vulnerability allows low privileged     attacker having None privilege with logon to the infrastructure where Oracle Spatial and Graph (OpenJPEG)     executes to compromise Oracle Spatial and Graph (OpenJPEG). Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Oracle Spatial and Graph (OpenJPEG).
    (CVE-2025-54874)

  - Vulnerability in the Fleet Patching and Provisioning (Eclipse Jersey) component of Oracle Database Server.
    Supported versions that are affected are 23.4.0-23.26.0. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Fleet Patching and Provisioning     (Eclipse Jersey). Successful attacks of this vulnerability can result in unauthorized creation, deletion     or modification access to critical data or all Fleet Patching and Provisioning (Eclipse Jersey) accessible     data as well as unauthorized access to critical data or complete access to all Fleet Patching and     Provisioning (Eclipse Jersey) accessible data. (CVE-2025-12383)

  - Vulnerability in the SQLcl component of Oracle Database Server. Supported versions that are affected are     23.4.0-23.26.0. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the     infrastructure where SQLcl executes to compromise SQLcl. Successful attacks require human interaction from     a person other than the attacker. Successful attacks of this vulnerability can result in takeover of     SQLcl. (CVE-2026-21939)

  - Vulnerability in the RDBMS (Python) component of Oracle Database Server. Supported versions that are     affected are 21.3-21.20 and 23.4.0-23.26.0. Easily exploitable vulnerability allows high privileged     attacker having Authenticated User privilege with logon to the infrastructure where RDBMS (Python)     executes to compromise RDBMS (Python). Successful attacks of this vulnerability can result in takeover of     RDBMS (Python). (CVE-2025-13836, CVE-2025-13837, CVE-2025-6069, CVE-2025-6075, CVE-2025-8194,     CVE-2025-8291, CVE-2025-8869)

  - Vulnerability in the Oracle Graal Development Kit for Micronaut (Nimbus JOSE+JWT) component of Oracle     Database Server. Supported versions that are affected are 19.3-19.29 and 23.4.0-23.26.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise     Oracle Graal Development Kit for Micronaut (Nimbus JOSE+JWT). Successful attacks of this vulnerability can     result in unauthorized update, insert or delete access to some of Oracle Graal Development Kit for     Micronaut (Nimbus JOSE+JWT) accessible data as well as unauthorized read access to a subset of Oracle     Graal Development Kit for Micronaut (Nimbus JOSE+JWT) accessible data. (CVE-2025-67735)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Enterprise Edition (OAS) 7.6.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory, including the following:

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Platform Security (OpenSSL)). Supported versions that are affected are 7.6.0.0.0, 8.2.0.0.0     and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access     via TLS to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Oracle Business Intelligence Enterprise Edition. (CVE-2025-9230)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (jackson-core)). Supported versions that are affected are 7.6.0.0.0 and     8.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of     Oracle Business Intelligence Enterprise Edition. (CVE-2025-52999)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Oracle Analytics Cloud). Supported versions that are affected are 7.6.0.0.0 and 8.2.0.0.0.     Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where     Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation,     deletion or modification access to critical data or all Oracle Business Intelligence Enterprise     Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle     Business Intelligence Enterprise Edition accessible data. (CVE-2026-21976)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Enterprise Edition 12.2.1.4 installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (json-smart)). Supported versions that are affected are 7.6.0.0.0, 8.2.0.0.0     and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of Oracle Business Intelligence Enterprise Edition. (CVE-2024-57699)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (Apache POI)). Supported versions that are affected are 7.6.0.0.0, 8.2.0.0.0     and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     multiple protocols to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of     this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS)     of Oracle Business Intelligence Enterprise Edition. (CVE-2025-31672)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Platform Security (Apache Commons Lang)). Supported versions that are affected are 7.6.0.0.0,     8.2.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network     access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Oracle Business Intelligence Enterprise Edition. (CVE-2025-48924)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Enterprise Edition (OAS) 8.2.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory, including the following:

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Core (Apache XMLBeans)). The supported version that is affected is 8.2.0.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise     Edition accessible data and unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Oracle Business Intelligence Enterprise Edition. (CVE-2021-23926)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (jackson-core)). Supported versions that are affected are 7.6.0.0.0 and     8.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of     Oracle Business Intelligence Enterprise Edition. (CVE-2025-52999)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Oracle Analytics Cloud). Supported versions that are affected are 7.6.0.0.0 and 8.2.0.0.0.     Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where     Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation,     deletion or modification access to critical data or all Oracle Business Intelligence Enterprise     Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle     Business Intelligence Enterprise Edition accessible data. (CVE-2026-21976)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:21213-1 advisory.

    - CVE-2025-9230: Fixed out-of-bounds read & write in RFC 3211 KEK unwrap (bsc#1250232)
    - CVE-2025-9231: Fixedk timing side-channel in SM2 algorithm on 64 bit ARM (bsc#1250233)
    - CVE-2025-9232: Fixed out-of-bounds read in HTTP client no_proxy handling (bsc#1250234)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025:20164-1 advisory.

    - CVE-2025-9230: Fixed out-of-bounds read & write in RFC 3211 KEK unwrap (bsc#1250232)
    - CVE-2025-9231: Fixedk timing side-channel in SM2 algorithm on 64 bit ARM (bsc#1250233)
    - CVE-2025-9232: Fixed out-of-bounds read in HTTP client no_proxy handling (bsc#1250234)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7894-1 advisory.

    It was discovered that EDK II was susceptible to a predictable TCP Initial Sequence Number. An attacker     could possibly use this issue to gain unauthorized access. This issue only affected Ubuntu 22.04 LTS, and     Ubuntu 24.04 LTS. (CVE-2023-45236, CVE-2023-45237)

    It was discovered that EDK II incorrectly handled S3 sleep. An attacker could possibly use this issue to     cause a denial of service. This issue only affected Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS.
    (CVE-2024-1298)

    It was discovered that the EDK II PE/COFF loader incorrectly handled certain memory operations. An     attacker could possibly use this issue to cause a denial of service, obtain sensitive information, or     execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2024-38796)

    It was discovered that the EDK II PE image hashing function incorrectly handled certain memory operations.
    An attacker could possibly use this issue to cause a denial of service, or execute arbitrary code.
    (CVE-2024-38797)

    It was discovered that the EDK II BIOS incorrectly handled certain memory operations. An attacker could     possibly use this issue to cause a denial of service. (CVE-2024-38805, CVE-2025-2295)

    It was discovered that EDK II incorrectly handled the enabling of MCE. An attacker could possibly use this     issue to cause a denial of service, or execute arbitrary code. (CVE-2025-3770)

    It was discovered that the OpenSSL library embedded in EDK II contained multiple vulnerabilties. An     attacker could possibly use these issues to cause a denial of service, obtain sensitive information, or     execute arbitrary code. (CVE-2021-3712, CVE-2022-0778, CVE-2022-4304, CVE-2022-4450, CVE-2023-0215,     CVE-2023-0286, CVE-2023-0464, CVE-2023-0465, CVE-2023-0466, CVE-2023-2650, CVE-2023-3446, CVE-2023-3817,     CVE-2023-5678, CVE-2023-6237, CVE-2024-0727, CVE-2024-13176, CVE-2024-2511, CVE-2024-41996, CVE-2024-4741,     CVE-2024-5535, CVE-2024-6119, CVE-2024-9143, CVE-2025-9232)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-4d34c066a1 advisory.

    Rebase to OpenSSL 3.5.4, resolving CVE-2025-9230 and CVE-2025-9232


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Essbase installed on the remote host is missing a security patch from the October 2025 Critical Patch Update (CPU). It is, therefore, affected by:

  - Vulnerability in Oracle Essbase (component: Security and Provisioning (Bouncy Castle Java Library)). The     supported version that is affected is 21.7.3.0.0. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTPS to compromise Oracle Essbase. Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Oracle Essbase. (CVE-2025-8916)

  - Vulnerability in Oracle Essbase (component: Security and Provisioning (Nimbus JOSE+JWT)). The supported     version that is affected is 21.7.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase,     attacks may significantly impact additional products (scope change). Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Oracle Essbase. (CVE-2025-53864)

  - Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is     affected is 21.7.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network     access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to critical data or all Oracle Essbase accessible     data as well as unauthorized access to critical data or complete access to all Oracle Essbase accessible     data. (CVE-2025-61763)   Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-e6f76d56fc advisory.

    Resolves: CVE-2025-9230, CVE-2025-9231, CVE-2025-9232

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-c355a1291c advisory.

    Resolves: CVE-2025-9230, CVE-2025-9231, CVE-2025-9232

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 00e912c5-9e92-11f0-bc5f-8447094a420f advisory.

    The OpenSSL project reports reports:
    Out-of-bounds read & write in RFC 3211 KEK Unwrap     Timing side-channel in SM2 algorithm on 64-bit ARM     Fix Out-of-bounds read in HTTP client no_proxy handling

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6015 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6015-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     October 01, 2025                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : openssl     CVE ID         : CVE-2025-9230 CVE-2025-9231 CVE-2025-9232

    Multiple vulnerabilities have been discovered in OpenSSL, a Secure     Sockets Layer toolkit, which may result in denial of service or     information leaks.

    Additional details can be found in the upstream advisory:
    https://openssl-library.org/news/secadv/20250930.txt

    For the oldstable distribution (bookworm), these problems have been fixed     in version 3.0.17-1~deb12u3.

    For the stable distribution (trixie), these problems have been fixed in     version 3.5.1-1+deb13u1.

    We recommend that you upgrade your openssl packages.

    For the detailed security status of openssl please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/openssl

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds     read if the 'no_proxy' environment variable is set and the host portion of the authority component of the     HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to     Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by     applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol)     client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be     controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash.
    Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the     OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned     reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch     releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and     3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module     boundary. (CVE-2025-9232)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7786-1 advisory.

    Stanislav Fort discovered that OpenSSL incorrectly handled memory when trying to decrypt CMS messages     encrypted with password-based encryption. An attacker could possibly use this issue to cause a denial of     service or execute arbitrary code. (CVE-2025-9230)

    Stanislav Fort discovered that OpenSSL had a timing side-channel in SM2 signature computations on ARM     platforms. A remote attacker could possibly use this issue to recover private data. This issue only     affected Ubuntu 25.04. (CVE-2025-9231)

    Stanislav Fort discovered that OpenSSL incorrectly handled memory during HTTP requests when no_proxy     environment variable is set. An attacker could possibly use this issue to cause a denial of service. This     issue only affected Ubuntu 25.04. (CVE-2025-9232)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenSSL installed on the remote host is prior to 3.2.6. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.2.6 advisory.

  - Issue summary: A timing side-channel which could potentially allow remote recovery of the private key     exists in the SM2 algorithm implementation on 64 bit ARM platforms. Impact summary: A timing side-channel     in SM2 signature computations on 64 bit ARM platforms could allow recovering the private key by an     attacker.. While remote key recovery over a network was not attempted by the reporter, timing measurements     revealed a timing signal which may allow such an attack. OpenSSL does not directly support certificates     with SM2 keys in TLS, and so this CVE is not relevant in most TLS contexts. However, given that it is     possible to add support for such certificates via a custom provider, coupled with the fact that in such a     custom provider context the private key may be recoverable via remote timing measurements, we consider     this to be a Moderate severity issue. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected     by this issue, as SM2 is not an approved algorithm. (CVE-2025-9231)

  - Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds     read if the 'no_proxy' environment variable is set and the host portion of the authority component of the     HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to     Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by     applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol)     client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be     controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash.
    Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the     OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned     reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch     releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and     3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module     boundary. (CVE-2025-9232)

  - Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can     trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which     leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which     can have various consequences including a Denial of Service or Execution of attacker-supplied code.
    Although the consequences of a successful exploit of this vulnerability could be severe, the probability     that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in     CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to     our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue,     as the CMS implementation is outside the OpenSSL FIPS module boundary. (CVE-2025-9230)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenSSL installed on the remote host is prior to 3.5.4. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.5.4 advisory.

  - Issue summary: A timing side-channel which could potentially allow remote recovery of the private key     exists in the SM2 algorithm implementation on 64 bit ARM platforms. Impact summary: A timing side-channel     in SM2 signature computations on 64 bit ARM platforms could allow recovering the private key by an     attacker.. While remote key recovery over a network was not attempted by the reporter, timing measurements     revealed a timing signal which may allow such an attack. OpenSSL does not directly support certificates     with SM2 keys in TLS, and so this CVE is not relevant in most TLS contexts. However, given that it is     possible to add support for such certificates via a custom provider, coupled with the fact that in such a     custom provider context the private key may be recoverable via remote timing measurements, we consider     this to be a Moderate severity issue. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected     by this issue, as SM2 is not an approved algorithm. (CVE-2025-9231)

  - Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds     read if the 'no_proxy' environment variable is set and the host portion of the authority component of the     HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to     Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by     applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol)     client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be     controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash.
    Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the     OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned     reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch     releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and     3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module     boundary. (CVE-2025-9232)

  - Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can     trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which     leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which     can have various consequences including a Denial of Service or Execution of attacker-supplied code.
    Although the consequences of a successful exploit of this vulnerability could be severe, the probability     that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in     CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to     our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue,     as the CMS implementation is outside the OpenSSL FIPS module boundary. (CVE-2025-9230)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenSSL installed on the remote host is prior to 3.0.18. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.0.18 advisory.

  - Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds     read if the 'no_proxy' environment variable is set and the host portion of the authority component of the     HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to     Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by     applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol)     client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be     controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash.
    Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the     OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned     reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch     releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and     3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module     boundary. (CVE-2025-9232)

  - Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can     trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which     leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which     can have various consequences including a Denial of Service or Execution of attacker-supplied code.
    Although the consequences of a successful exploit of this vulnerability could be severe, the probability     that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in     CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to     our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue,     as the CMS implementation is outside the OpenSSL FIPS module boundary. (CVE-2025-9230)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenSSL installed on the remote host is prior to 3.4.3. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.4.3 advisory.

  - Issue summary: A timing side-channel which could potentially allow remote recovery of the private key     exists in the SM2 algorithm implementation on 64 bit ARM platforms. Impact summary: A timing side-channel     in SM2 signature computations on 64 bit ARM platforms could allow recovering the private key by an     attacker.. While remote key recovery over a network was not attempted by the reporter, timing measurements     revealed a timing signal which may allow such an attack. OpenSSL does not directly support certificates     with SM2 keys in TLS, and so this CVE is not relevant in most TLS contexts. However, given that it is     possible to add support for such certificates via a custom provider, coupled with the fact that in such a     custom provider context the private key may be recoverable via remote timing measurements, we consider     this to be a Moderate severity issue. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected     by this issue, as SM2 is not an approved algorithm. (CVE-2025-9231)

  - Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds     read if the 'no_proxy' environment variable is set and the host portion of the authority component of the     HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to     Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by     applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol)     client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be     controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash.
    Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the     OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned     reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch     releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and     3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module     boundary. (CVE-2025-9232)

  - Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can     trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which     leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which     can have various consequences including a Denial of Service or Execution of attacker-supplied code.
    Although the consequences of a successful exploit of this vulnerability could be severe, the probability     that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in     CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to     our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue,     as the CMS implementation is outside the OpenSSL FIPS module boundary. (CVE-2025-9230)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenSSL installed on the remote host is prior to 3.3.5. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.3.5 advisory.

  - Issue summary: A timing side-channel which could potentially allow remote recovery of the private key     exists in the SM2 algorithm implementation on 64 bit ARM platforms. Impact summary: A timing side-channel     in SM2 signature computations on 64 bit ARM platforms could allow recovering the private key by an     attacker.. While remote key recovery over a network was not attempted by the reporter, timing measurements     revealed a timing signal which may allow such an attack. OpenSSL does not directly support certificates     with SM2 keys in TLS, and so this CVE is not relevant in most TLS contexts. However, given that it is     possible to add support for such certificates via a custom provider, coupled with the fact that in such a     custom provider context the private key may be recoverable via remote timing measurements, we consider     this to be a Moderate severity issue. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected     by this issue, as SM2 is not an approved algorithm. (CVE-2025-9231)

  - Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds     read if the 'no_proxy' environment variable is set and the host portion of the authority component of the     HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to     Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by     applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol)     client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be     controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash.
    Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the     OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned     reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch     releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and     3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module     boundary. (CVE-2025-9232)

  - Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can     trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which     leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which     can have various consequences including a Denial of Service or Execution of attacker-supplied code.
    Although the consequences of a successful exploit of this vulnerability could be severe, the probability     that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in     CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to     our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue,     as the CMS implementation is outside the OpenSSL FIPS module boundary. (CVE-2025-9230)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
505092	Siemens S7-1500 Out-of-bounds Read (CVE-2025-9232)	Tenable OT Security	Tenable.ot	medium
297823	Photon OS 4.0: Openssl PHSA-2026-4.0-0952	Nessus	PhotonOS Local Security Checks	high
296583	Oracle MySQL Server 8.4.x < 8.4.8 (January 2026 CPU)	Nessus	Databases	high
296582	Oracle MySQL Server 9.x.x < 9.6.0 (January 2026 CPU)	Nessus	Databases	high
296581	Oracle MySQL Server 8.0.x < 8.0.45 (January 2026 CPU)	Nessus	Databases	high
296415	Oracle Business Intelligence Publisher (January 2026 CPU)	Nessus	Misc.	high
296378	Oracle Database Server (January 2026 CPU)	Nessus	Databases	critical
296370	Oracle Business Intelligence Enterprise Edition (OAS 7.6) (January 2026 CPU)	Nessus	Misc.	high
296369	Oracle Business Intelligence Enterprise Edition (12.2.1.4) (January 2026 CPU)	Nessus	Misc.	medium
296368	Oracle Business Intelligence Enterprise Edition (OAS 8.2) (January 2026 CPU)	Nessus	Misc.	high
279362	SUSE SLES16 Security Update : openssl-3 (SUSE-SU-2025:21213-1)	Nessus	SuSE Local Security Checks	medium
279057	openSUSE 16 Security Update : openssl-3 (openSUSE-SU-2025:20164-1)	Nessus	SuSE Local Security Checks	medium
277312	Ubuntu 22.04 LTS / 24.04 LTS / 25.04 : EDK II vulnerabilities (USN-7894-1)	Nessus	Ubuntu Local Security Checks	high
271448	Fedora 43 : openssl (2025-4d34c066a1)	Nessus	Fedora Local Security Checks	high
271378	Oracle Essbase Multiple Vulnerabilities (October 2025 CPU)	Nessus	Misc.	high
271246	Photon OS 5.0: Openssl PHSA-2025-5.0-0648	Nessus	PhotonOS Local Security Checks	high
270121	Fedora 41 : openssl (2025-e6f76d56fc)	Nessus	Fedora Local Security Checks	medium
269689	Fedora 42 : openssl (2025-c355a1291c)	Nessus	Fedora Local Security Checks	medium
266387	FreeBSD : OpenSSL -- multiple vulnerabilities (00e912c5-9e92-11f0-bc5f-8447094a420f)	Nessus	FreeBSD Local Security Checks	medium
266357	Debian dsa-6015 : libcrypto3-udeb - security update	Nessus	Debian Local Security Checks	medium
266346	Linux Distros Unpatched Vulnerability : CVE-2025-9232	Nessus	Misc.	medium
266334	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 : OpenSSL vulnerabilities (USN-7786-1)	Nessus	Ubuntu Local Security Checks	medium
266319	OpenSSL 3.2.0 < 3.2.6 Multiple Vulnerabilities	Nessus	Web Servers	medium
266298	OpenSSL 3.5.0 < 3.5.4 Multiple Vulnerabilities	Nessus	Web Servers	medium
266297	OpenSSL 3.0.0 < 3.0.18 Multiple Vulnerabilities	Nessus	Web Servers	high
266295	OpenSSL 3.4.0 < 3.4.3 Multiple Vulnerabilities	Nessus	Web Servers	medium
266293	OpenSSL 3.3.0 < 3.3.5 Multiple Vulnerabilities	Nessus	Web Servers	medium

Detections

Analytics

CVE-2025-9232

medium

Tenable Plugins

medium

high

high

high

high

high

critical

high

medium

high

medium

medium

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium