Debian Linux - libsolv - None

Ubuntu Linux - [Unknown description]

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1798 advisory.

    A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification     component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote     attacker could craft a malicious Ed25519 PGP signature with mismatched MPI lengths. Processing this     crafted signature could lead to a denial of service in automated package or repository processing     workflows. (CVE-2026-48863)

    A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-     controlled compressed data within `.solv` files due to insufficient input validation. An attacker can     provide a specially crafted `.solv` file, which, when processed by a vulnerable application, can lead to     out-of-bounds memory access. This could result in information disclosure, alteration of program execution,     or a denial of service. (CVE-2026-48864)

    A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a     specially crafted .solv file containing negative size values in the repo_add_solv function. This leads to     an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this to     cause a denial of service (DoS). (CVE-2026-9149)

    A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian     metadata parser when processing specially crafted Debian repository metadata. An attacker could exploit     this by providing malicious SHA384 or SHA512 checksum tags, leading to memory corruption and a denial of     service (DoS) in the affected system. (CVE-2026-9150)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0423 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-48863:
    libsolv: Stack-based buffer overflow in libsolv EdDSA PGP signature verification allows denial of service

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Debian Linux - libsolv - None  Ubuntu Linux - [Unknown description] (CVE-2026-48863)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
319848	Amazon Linux 2023 : libsolv, libsolv-demo, libsolv-devel (ALAS2023-2026-1798)	Nessus	Amazon Linux Local Security Checks	medium
319755	TencentOS Server 4: libsolv (TSSA-2026:0423)	Nessus	Tencent Local Security Checks	high
317683	Linux Distros Unpatched Vulnerability : CVE-2026-48863	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-48863

high

Tenable Plugins

medium

high

critical