By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2f88b83676 advisory.

    - Fix QUIC zero-length UDP datagrams busy-loop (CVE-2026-11352)
    - Fix WS Auto-PONG memory exhaustion (CVE-2026-11586)
    - Fix proto-default skips SSH verification (CVE-2026-12064)
    - Fix wrong STARTTLS connection reuse (CVE-2026-8286)
    - Fix SASL double-free (CVE-2026-8925)
    - Fix env-set cross-proxy Digest auth state leak (CVE-2026-8927)
    - Fix sending old referer (CVE-2026-9546)
    - Fix exposing HTTP/3 early data (CVE-2026-9545)
    - Fix UAF after pause in socket callback (CVE-2026-9080)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable Security Center running on the remote host is prior to 6.9.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-22 advisory.

  - libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a     pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.
    When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network     transfer operation that was requested by an application could wrongfully reuse an existing SMB connection     to the same server that was using a different 'share' than the new subsequent transfer should. This could     in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place.
    When this happens, the same credentials are used and the server name is the same. (CVE-2026-5773)

  - libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of     them matches the setup. An easy handle that first uses default native CA trust can continue trusting the     native platform store after the application switches that same handle to custom CA material for a later     transfer. (CVE-2026-11564)

  - A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker     could exploit this issue to execute arbitrary commands on the underlying operating system with the     privileges of the service account. (CVE-2026-19682)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the curl package has been released.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8525-1 advisory.

    Harry Sintonen discovered that curl incorrectly handled credentials when following HTTP redirects in     conjunction with .netrc files. An attacker could possibly use this issue to obtain sensitive information.
    This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2024-11053)

    Hiroki Kurosawa discovered that curl incorrectly handled OCSP stapling responses. A remote attacker could     possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS and     Ubuntu 18.04 LTS. (CVE-2024-8096)

    Joshua Rogers discovered that curl had a use-after-free vulnerability when resetting and cleaning up     HTTP/2 stream handles. An attacker could possibly use this issue to cause a denial of service or execute     arbitrary code. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10.
    (CVE-2026-10536)

    Quac Tran and Ngoc Hieu discovered that curl incorrectly reused connections when switching authentication     methods to the same host. An attacker could possibly use this issue to obtain sensitive information or     perform unauthorized actions. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-5545)

    Osama Hamad discovered that curl incorrectly reused SMB connections when the target share differed between     transfers. An attacker could possibly use this issue to obtain sensitive information. This issue only     affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-5773)

    Muhamad Arga Reksapati discovered that curl incorrectly forwarded Digest proxy authentication credentials     to a different proxy host. An attacker could possibly use this issue to obtain sensitive information. This     issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-7168)

    It was discovered that curl incorrectly skipped SSH host verification options when using schemeless URLs     with --proto-default. An attacker could possibly use this issue to perform machine-in-the-middle attacks.
    This issue only affected Ubuntu 25.04 and Ubuntu 25.10. (CVE-2026-12064)

    It was discovered that curl did not enforce an upper bound on memory allocated for unacknowledged     WebSocket PING frames. A remote attacker could possibly use this issue to cause a denial of service. This     issue only affected Ubuntu 25.10. (CVE-2026-11586)

    It was discovered that curl could stall indefinitely when a malicious HTTP/3 server sent a continuous     stream of empty UDP datagrams. A remote attacker could possibly use this issue to cause a denial of     service. This issue only affected Ubuntu 25.10. (CVE-2026-11352)

    It was discovered that curl could incorrectly continue trusting a native platform CA store after an     application switched the handle to use custom CA material. An attacker could possibly use this issue to     obtain sensitive information. This issue only affected Ubuntu 25.10. (CVE-2026-11564)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libcurl installed on the remote host is 8.16.0 prior to 8.21.0. It is, therefore, affected by a denial of service vulnerability:

  - By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on     memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by     flooding curl with rapid, sequential PING messages. (CVE-2026-11586)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of curl installed on the remote host is 8.16.0 prior to 8.21.0. It is, therefore, affected by a denial of service vulnerability:

  - Because curl lacks an upper bound on memory allocation for unacknowledged WebSocket frames, a malicious     server can exhaust all available memory by flooding curl with rapid sequential PING messages.
    (CVE-2026-11586)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
340980	Fedora 44 : curl (2026-2f88b83676)	Nessus	Fedora Local Security Checks	Local	critical
339129	Tenable Security Center < 6.9.0 Multiple Vulnerabilities (TNS-2026-22)	Nessus	Misc.	Combined	critical
334708	Photon OS 5.0: Curl PHSA-2026-5.0-90-0951	Nessus	PhotonOS Local Security Checks	Local	critical
326253	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 24.04 LTS / 26.04 LTS : curl vulnerabilities (USN-8525-1)	Nessus	Ubuntu Local Security Checks	Local	high
326239	libcurl 8.16.0 < 8.21.0 WebSocket Auto-PONG Memory Exhaustion (CVE-2026-11586)	Nessus	Misc.	Local	high
323012	Curl 8.16.0 < 8.21.0 WebSocket Auto-PONG Memory Exhaustion	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-11586

high

Tenable Plugins

critical

critical

critical

high

high

high