Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though Netty 4.2 sets endpointIdentificationAlgorithm="HTTPS" by default, a client built with `SslContextBuilder.forClient().trustManager(somePlainX509TrustManager)` performs no hostname verification at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

According to its self-reported version number, the Atlassian Crowd application running on the remote host is prior to 7.2.2. It is, therefore, affected by multiple vulnerabilities, including flaws in bundled third-party dependencies :

- A broken authentication and session management vulnerability in Atlassian Crowd. (CVE-2026-21582)

- Multiple denial of service vulnerabilities in the bundled Netty dependency. (CVE-2026-56745, CVE-2026-59901, CVE-2026-45416, CVE-2026-55831, CVE-2026-55833, CVE-2026-48043, CVE-2026-56819)

- Multiple injection vulnerabilities in the bundled axios dependency. (CVE-2026-44494, CVE-2026-42041, CVE-2026-44490, CVE-2026-42035, CVE-2026-42033)

- A server-side request forgery (SSRF) vulnerability in the bundled axios dependency. (CVE-2026-44492)

- Multiple information disclosure vulnerabilities in the bundled axios dependency. (CVE-2026-67320, CVE-2026-44487, CVE-2026-44486)

- A SQL injection vulnerability in the bundled Hibernate ORM dependency. (CVE-2026-0603)

- A man-in-the-middle vulnerability in the bundled PostgreSQL JDBC Driver dependency. (CVE-2026-54291)

- A denial of service vulnerability in the bundled underscore dependency. (CVE-2026-27601)

- Multiple insecure deserialization vulnerabilities in the bundled jackson-databind dependency. (CVE-2026-54513, CVE-2026-54512)

- An improper authorization vulnerability in the bundled Netty dependency. (CVE-2026-44249)

- A broken authentication and session management vulnerability in the bundled Spring Security dependency. (CVE-2026-47838)

- A denial of service vulnerability in the bundled Apache Tomcat dependency. (CVE-2026-41284)

- Multiple denial of service vulnerabilities in the bundled Spring Framework dependency. (CVE-2026-41842, CVE-2026-41851, CVE-2026-41850)

- A man-in-the-middle vulnerability in the bundled Netty dependency. (CVE-2026-50010)

- Multiple denial of service vulnerabilities in the bundled axios dependency. (CVE-2026-44496, CVE-2026-44488)

- Multiple denial of service vulnerabilities in the bundled Micrometer dependency. (CVE-2026-40983, CVE-2026-40984)

- An information disclosure vulnerability in the bundled postcss dependency. (CVE-2026-45623)

- A business logic vulnerability in the bundled Apache Tomcat dependency. (CVE-2026-43513)

- An injection vulnerability in the bundled js-cookie dependency. (CVE-2026-46625)

- A cross-site scripting (XSS) vulnerability in the bundled Spring Framework dependency. (CVE-2026-41845)

- A remote code execution vulnerability in the bundled axios dependency. (CVE-2026-44495)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Atlassian Jira application running on the remote host is prior to 10.3.24 or 10.4.x prior to 11.3.10. It is, therefore, affected by multiple vulnerabilities, including flaws in bundled third-party dependencies :

- A remote code execution vulnerability in the bundled lodash dependency. (CVE-2026-4800)

- A remote code execution vulnerability in the bundled @babel/traverse dependency. (CVE-2023-45133)

- Multiple denial of service vulnerabilities in the bundled node-tar dependency. (CVE-2026-59873, CVE-2026-59874, CVE-2026-59871)

- A broken authentication and session management vulnerability in Atlassian Jira. (CVE-2026-21582)

- A file inclusion vulnerability in the bundled rollup dependency. (CVE-2026-27606)

- An injection vulnerability in the bundled axios dependency. (CVE-2026-44494)

- Multiple denial of service vulnerabilities in the bundled Netty dependency. (CVE-2026-59901, CVE-2026-56745, CVE-2026-55833, CVE-2026-56819, CVE-2026-45416, CVE-2026-48043, CVE-2026-42587, CVE-2026-55831, CVE-2026-42583)

- A denial of service vulnerability in the bundled react-router dependency. (CVE-2026-55685)

- A remote code execution vulnerability in the bundled form-data dependency. (CVE-2026-12143)

- A server-side request forgery (SSRF) vulnerability in the bundled axios dependency. (CVE-2026-44492)

- A man-in-the-middle vulnerability in the bundled PostgreSQL JDBC Driver dependency. (CVE-2026-54291)

- Multiple information disclosure vulnerabilities in the bundled axios dependency. (CVE-2026-44487, CVE-2026-44486)

- An improper authorization vulnerability in the bundled Netty dependency. (CVE-2026-44249)

- A broken authentication and session management vulnerability in the bundled Spring Security dependency. (CVE-2026-47838)

- A server-side request forgery (SSRF) vulnerability in the bundled ip-address dependency. (CVE-2026-69192)

- A denial of service vulnerability in the bundled brace-expansion dependency. (CVE-2026-13149)

- An injection vulnerability in the bundled js-cookie dependency. (CVE-2026-46625)

- A man-in-the-middle vulnerability in the bundled Netty dependency. (CVE-2026-50010)

- A denial of service vulnerability in the bundled undici dependency. (CVE-2026-12151)

- An injection vulnerability in the bundled Apache Tomcat dependency. (CVE-2026-24734)

- A denial of service vulnerability in the bundled Spring Framework dependency. (CVE-2026-41842)

- A denial of service vulnerability in the bundled axios dependency. (CVE-2026-44488)

- A denial of service vulnerability in the bundled Micrometer dependency. (CVE-2026-40983)

- A cross-site scripting (XSS) vulnerability in the bundled Spring Framework dependency. (CVE-2026-41845)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 9.2.24 or 9.3.x prior to 10.2.17. It is, therefore, affected by multiple vulnerabilities, including flaws in bundled third-party dependencies :

- Multiple man-in-the-middle vulnerabilities in the bundled Netty dependency. (CVE-2026-45674, CVE-2026-47691)

- A remote code execution vulnerability in the bundled lodash dependency. (CVE-2026-4800)

- An injection vulnerability in the bundled Bouncy Castle dependency. (CVE-2026-59650)

- Multiple broken authentication and session management vulnerabilities in the bundled Bouncy Castle dependency. (CVE-2026-8763, CVE-2026-12803, CVE-2026-12802, CVE-2026-59642, CVE-2026-59639, CVE-2026-12816)

- Multiple broken authentication and session management vulnerabilities in the bundled Apache Tomcat dependency. (CVE-2026-55276, CVE-2026-53404)

- Multiple denial of service vulnerabilities in the bundled Netty dependency. (CVE-2026-56745, CVE-2026-59901, CVE-2026-48043, CVE-2026-45416, CVE-2026-73507, CVE-2026-56819, CVE-2026-55833, CVE-2026-55831)

- Multiple denial of service vulnerabilities in the bundled Immutable.js dependency. (CVE-2026-59880, CVE-2026-59879)

- Multiple denial of service vulnerabilities in the bundled Bouncy Castle dependency. (CVE-2026-13506, CVE-2026-58059)

- Multiple remote code execution vulnerabilities in the bundled Bouncy Castle dependency. (CVE-2026-14682, CVE-2026-58060)

- An improper authorization vulnerability in the bundled Netty dependency. (CVE-2026-44249)

- A denial of service vulnerability in the bundled node-tar dependency. (CVE-2026-73566)

- A broken authentication and session management vulnerability in the bundled Netty dependency. (CVE-2026-50010)

- A cross-site request forgery (CSRF) vulnerability in the bundled nanoid dependency. (CVE-2026-73086)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:76128 advisory.

    Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides     authentication and standards-based single sign-on capabilities for web and mobile applications.

    This release of Red Hat Single Sign-On 7.6.13 on RHEL 7 serves as a replacement for Red Hat Single Sign-On     7.6.12, and includes bug fixes and enhancements, which are documented in the Release Notes document linked     to in the References.

    Security Fix(es):
    * undertow-core: Undertow MadeYouReset HTTP/2 DDoS Vulnerability (CVE-2025-9784)
    * Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and     SSRF (CVE-2025-12543)
    * Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and     SSRF (CVE-2025-12543)
    * Information disclosure and data deletion via second-order SQL injection (CVE-2026-0603)
    * GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)
    * PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588)
    * unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (CVE-2026-3505)
    * High integrity impact due to improper DNS domain name constraint enforcement (CVE-2026-42579)
    * HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers (CVE-2026-42581)
    * HTTP Header Injection via HttpProxyHandler Disabled Validation (CVE-2026-42578)
    * Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587)
    * Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587)
    * IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249)
    * Denial of Service via malformed HAProxy message (CVE-2026-44893)
    * Denial of Service due to resource leak (CVE-2026-48043)
    * Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol     headers (CVE-2026-48059)
    * Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691)
    * Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010)
    * Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674)
    * Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416)
    * Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512)
    * Denial of Service via deeply nested JSON processing (CVE-2026-50193)
    * Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494)
    * Missing authentication on EAP's IIOP NameService leads to MITM or DoS (CVE-2026-15563)
    * Session fixation in OIDC login flow that can lead to account takeover (CVE-2026-7507)
    * Denial of Service via specially crafted SAML input (CVE-2026-7307)
    * Denial of Service due to excessive SAMLRequest decompression (CVE-2026-2575)
    * Denial of Service via excessive processing of OpenID Connect scope parameters (CVE-2026-4634)
    * Unauthorized access via improper validation of encrypted SAML assertions (CVE-2026-2092)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:76129 advisory.

    Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides     authentication and standards-based single sign-on capabilities for web and mobile applications.

    This release of Red Hat Single Sign-On 7.6.13 on RHEL 8 serves as a replacement for Red Hat Single Sign-On     7.6.12, and includes bug fixes and enhancements, which are documented in the Release Notes document linked     to in the References.

    Security Fix(es):
    * undertow-core: Undertow MadeYouReset HTTP/2 DDoS Vulnerability (CVE-2025-9784)
    * Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and     SSRF (CVE-2025-12543)
    * Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and     SSRF (CVE-2025-12543)
    * Information disclosure and data deletion via second-order SQL injection (CVE-2026-0603)
    * GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)
    * PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588)
    * unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (CVE-2026-3505)
    * High integrity impact due to improper DNS domain name constraint enforcement (CVE-2026-42579)
    * HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers (CVE-2026-42581)
    * HTTP Header Injection via HttpProxyHandler Disabled Validation (CVE-2026-42578)
    * Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587)
    * Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587)
    * IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249)
    * Denial of Service via malformed HAProxy message (CVE-2026-44893)
    * Denial of Service due to resource leak (CVE-2026-48043)
    * Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol     headers (CVE-2026-48059)
    * Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691)
    * Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010)
    * Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674)
    * Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416)
    * Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512)
    * Denial of Service via deeply nested JSON processing (CVE-2026-50193)
    * Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494)
    * Missing authentication on EAP's IIOP NameService leads to MITM or DoS (CVE-2026-15563)
    * Session fixation in OIDC login flow that can lead to account takeover (CVE-2026-7507)
    * Denial of Service via specially crafted SAML input (CVE-2026-7307)
    * Denial of Service due to excessive SAMLRequest decompression (CVE-2026-2575)
    * Denial of Service via excessive processing of OpenID Connect scope parameters (CVE-2026-4634)
    * Unauthorized access via improper validation of encrypted SAML assertions (CVE-2026-2092)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:76130 advisory.

    Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides     authentication and standards-based single sign-on capabilities for web and mobile applications.

    This release of Red Hat Single Sign-On 7.6.13 on RHEL 9 serves as a replacement for Red Hat Single Sign-On     7.6.12, and includes bug fixes and enhancements, which are documented in the Release Notes document linked     to in the References.

    Security Fix(es):
    * undertow-core: Undertow MadeYouReset HTTP/2 DDoS Vulnerability (CVE-2025-9784)
    * Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and     SSRF (CVE-2025-12543)
    * Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and     SSRF (CVE-2025-12543)
    * Information disclosure and data deletion via second-order SQL injection (CVE-2026-0603)
    * GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)
    * PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588)
    * unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (CVE-2026-3505)
    * High integrity impact due to improper DNS domain name constraint enforcement (CVE-2026-42579)
    * HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers (CVE-2026-42581)
    * HTTP Header Injection via HttpProxyHandler Disabled Validation (CVE-2026-42578)
    * Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587)
    * Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587)
    * IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249)
    * Denial of Service via malformed HAProxy message (CVE-2026-44893)
    * Denial of Service due to resource leak (CVE-2026-48043)
    * Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol     headers (CVE-2026-48059)
    * Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691)
    * Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010)
    * Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674)
    * Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416)
    * Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512)
    * Denial of Service via deeply nested JSON processing (CVE-2026-50193)
    * Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494)
    * Missing authentication on EAP's IIOP NameService leads to MITM or DoS (CVE-2026-15563)
    * Session fixation in OIDC login flow that can lead to account takeover (CVE-2026-7507)
    * Denial of Service via specially crafted SAML input (CVE-2026-7307)
    * Denial of Service due to excessive SAMLRequest decompression (CVE-2026-2575)
    * Denial of Service via excessive processing of OpenID Connect scope parameters (CVE-2026-4634)
    * Unauthorized access via improper validation of encrypted SAML assertions (CVE-2026-2092)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Netty is a network application framework for development of protocol servers and clients. Prior to
    versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related
    paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends
    X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by
    discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an
    X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own
    OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though
    Netty 4.2 sets endpointIdentificationAlgorithm="HTTPS" by default, a client built with
    `SslContextBuilder.forClient().trustManager(somePlainX509TrustManager)` performs no hostname verification
    at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue. (CVE-2026-50010)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:53644 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.25 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 7.4.24, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.25 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * netty-codec-redis: Netty: Denial of Service via malicious Redis array header (CVE-2026-50011)

    * netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416)

    * netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested     arrays (CVE-2026-44250)

    * netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payloads (CVE-2026-44890)

    * netty-transport-sctp: Netty-transport-sctp: Denial of Service due to unbounded memory growth from     SctpMessage fragments (CVE-2026-46340)

    * netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record     validation (CVE-2026-45674)

    * netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass     (CVE-2026-50010)

    * netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in     RedisArrayAggregator (CVE-2026-48006)

    * netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691)

    * netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from     crafted PROXY protocol headers (CVE-2026-48059)

    * netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak (CVE-2026-48043)

    * netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message     (CVE-2026-44893)

    * netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing (CVE-2026-42585)

    * netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content     decompression (CVE-2026-42587)

    * netty-codec-http: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression     (CVE-2026-42587)

    * netty-codec-http: Netty: HTTP request smuggling via URI manipulation and CRLF injection (CVE-2026-41417)

    * netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation     (CVE-2026-42578)

    * netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers     (CVE-2026-42581)

    * netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion (CVE-2026-42584)

    * netty-codec-dns: Netty: High integrity impact due to improper DNS domain name constraint enforcement     (CVE-2026-42579)

    * picketlink-federation: auth bypass in Picketlink SAML unsolicited-response (CVE-2026-10579)

    * bcprov-jdk18on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)

    * bcprov-jdk15on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)

    * bcprov-jdk15: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)

    * bcprov-jdk12: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)

    * bcpg-jdk18on: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (CVE-2026-3505)

    * bcpg-jdk15on: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (CVE-2026-3505)

    * bcpkix-jdk18on: PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588)

    * bcpkix-jdk15on: PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588)

    * bcprov-jdk18on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)

    * bcprov-jdk15on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)

    * bcprov-jdk15: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)

    * bcprov-jdk12: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)

    * bcprov-jdk15: private key leakage via non-constant time comparisons (CVE-2026-5598)

    * bcprov-jdk12: private key leakage via non-constant time comparisons (CVE-2026-5598)

    * artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to     missing authentication (CVE-2026-27446)

    * undertow-core: Undertow: Authentication Bypass via AJP ssl_cert/is_ssl Forgery (CVE-2026-15554)

    * wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller     (CVE-2026-15555)

    * picketlink-federation: picketlink SAML 2.0 auth bypass via missing assertions (CVE-2026-15556)

    * openjdk-orb: unauthed class loading via IIOP in EAP (CVE-2026-15560)

    * undertow-core: OOM via missing limits in chunked trailer in EAP's Undertow (CVE-2026-15561)

    * jboss-remoting: jboss-remoting: integer overflow in MessageReader leads to pre-authentication denial of     service (CVE-2026-15562)

    * wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS     (CVE-2026-15563)

    * jsf-impl: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include     (CVE-2026-46581)

    * netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation     (CVE-2026-44249)

    * jackson-core: Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:49700 advisory.

    Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly     application runtime.

    This asynchronous patch is an update for Red Hat JBoss Enterprise Application Platform 8.1. See Release     Notes for information about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416)

    * netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record     validation (CVE-2026-45674)

    * netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass     (CVE-2026-50010)

    * netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691)

    * netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation     (CVE-2026-44249)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2802-1 advisory.

    This update for netty, netty-tcnative fixes the following issue

    This update for netty, netty-tcnative fixes the following issues

    Upgrade netty to upstream version 4.1.135, netty-tcnative to upstream version 2.0.79:

    - CVE-2026-44249: IPv6 Subnet Filter Bypass via Incorrect Comparator Masking (bsc#1268165).
    - CVE-2026-44250: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays (bsc#1268169).
    - CVE-2026-44890: Unbounded Direct Memory Consumption in RedisDecoder (bsc#1268170).
    - CVE-2026-44893: netty-codec-haproxy: Denial of Service via malformed HAProxy message (bsc#1268244).
    - CVE-2026-45416: SNI handler pre-allocates up to 16 MiB from nine attacker bytes (bsc#1268246).
    - CVE-2026-45536: Unix-socket fd receive leaks descriptors when peer sends two at once (bsc#1268247).
    - CVE-2026-45673: netty-resolver-dns: DNS Cache Poisoning via predictable transaction IDs (bsc#1268248).
    - CVE-2026-45674: DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records (bsc#1268249).
    - CVE-2026-46340: netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage     fragments       (bsc#1268250).
    - CVE-2026-47244: HTTP/2: Advertised MAX_CONCURRENT_STREAMS not enforced (bsc#1268251).
    - CVE-2026-47691: Insufficient Bailiwick Validation for NS Records (bsc#1268252).
    - CVE-2026-48006: netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in       RedisArrayAggregator (bsc#1268255).
    - CVE-2026-48043: netty-codec-http2: Denial of Service due to resource leak (bsc#1268257).
    - CVE-2026-48059: netty-codec-haproxy: Denial of Service via memory leak from crafted PROXY protocol     headers       (bsc#1268258).
    - CVE-2026-50010: Wrapping plain trust manager silently disables hostname verification (bsc#1268259).
    - CVE-2026-50011: Unbounded pre-allocation in RedisArrayAggregator from RESP array length (bsc#1268260).
    - CVE-2026-50020: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF     characters are       permitted (bsc#1268261).
    - CVE-2026-50560: Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature     (bsc#1268262).

    Changes:

     - MQTT: Allow MQTT 5 CONNECT with password only      + ChannelInitializer: correct misleading comment on      exceptionCaught route      + HTTP/2: Parse request-target path like Vert.x (4.1 backport)      + HttpObjectDecoder skips arbitrary initial control characters      when only initial CRLF characters are permitted      + IpSubnetFilter: Correctly handle ipv6      + Configurable bound on RedisArrayAggregator      + Redis: Limit decoded length      + DNS: Ensure query id is not predictible      + Wrapping plain trust manager silently disables hostname      verification      + MQTT: Reject malformed no-payload packets with non-zero      Remaining Length      + HAProxy: Reject HAProxyMessages with malformated TLV and not      leak memory      + SSL: Use sane defaults as limits for the client hello length      and timeout      + DNS: Only cache CNAME if part of the queried domain      + HTTP/2: Enforce max concurrent streams for misbehaving clients      + Dns: Insufficient Bailiwick Validation for NS Records      + HTTP2: DelegatingDecompressorFrameListener must release memory      in all cases      + Pass maxAllocation to Brotli and Zstd decoders      + HTTP/2: Treat clients MAX_HEADER_LIST_SIZE as advisory      + Add maxWindowLog parameter to ZstdDecoder to bound memory      allocation      + HAProxy: Fix ByteBuf leak when parsing nested SSL TLVs      + Epoll / Kqueue: Correctly handle receive of FD      + SCTP: Limit the number of inflight incomplete SCTP messages      and the number of fragments      + Redis: Correctly release incomplete message on removal when      using RedisArrayAggregator      + Redis: Limit the maximum number of nested arrays      + HTTP: Re-add constructor to HttpProxyHandler that was removed      by mistake      + Marshalling: Explicit document security requirements      + Pin HTTP/RTSP version + method normalization to Locale.US      + Adaptive: Fix concurrency issue in adaptive allocator      + Pin multipart Content-Type / Content-Transfer-Encoding case      folding to Locale.US      + Remove dead native declarations      + Avoid re-parsing openssl key material with non-cached provider      + IpFilter: Fix ClassCastException caused by IpSubnetFilter if      only ipv6 rules are configured but remote peer is using ipv4      + Resolve all localhost addresses without querying DNS servers      + HTTP2: Use 100 as default max concurrent streams setting      + Route synchronous onLookupComplete exceptions via      fireExceptionCaught      + Fix MQTT decoder size check after variable header replay

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Netty is a network application framework for development of protocol servers and clients. Prior to     versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related     paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends     X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by     discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an     X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own     OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though     Netty 4.2 sets endpointIdentificationAlgorithm=HTTPS by default, a client built with     `SslContextBuilder.forClient().trustManager(somePlainX509TrustManager)` performs no hostname verification     at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue. (CVE-2026-50010)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
115706	Atlassian Crowd < 7.2.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115700	Atlassian Jira 10.4.x < 11.3.10 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
115699	Atlassian Jira < 10.3.24 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
115690	Atlassian Confluence 9.3.x < 10.2.17 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
115689	Atlassian Confluence < 9.2.24 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
363386	RHEL 7 : Red Hat Single Sign-On 7.6.13 security update on RHEL 7 (Important) (RHSA-2026:76128)	Nessus	Red Hat Local Security Checks	Local	critical
363126	RHEL 8 : Red Hat Single Sign-On 7.6.13 security update on RHEL 8 (Important) (RHSA-2026:76129)	Nessus	Red Hat Local Security Checks	Local	critical
363125	RHEL 9 : Red Hat Single Sign-On 7.6.13 security update on RHEL 9 (Important) (RHSA-2026:76130)	Nessus	Red Hat Local Security Checks	Local	critical
460929	Echo: io.netty:netty-handler: security update to 4.1.135.Final	Tenable Cloud Security	Echo Local Security Checks	Local	high
460929	Echo: io.netty:netty-handler: security update to 4.1.135.Final	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
334631	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.25 security pdate (Important) (RHSA-2026:53644)	Nessus	Red Hat Local Security Checks	Local	critical
331717	RHEL 10 / 8 / 9 : Red Hat JBoss Enterprise Application Platform 8.1.7 (RHSA-2026:49700)	Nessus	Red Hat Local Security Checks	Local	critical
326003	SUSE SLED15 / SLES15 Security Update : netty, netty-tcnative (SUSE-SU-2026:2802-1)	Nessus	SuSE Local Security Checks	Local	high
443254	SCA: security update for io.netty:netty-handler (GHSA-c653-97m9-rcg9)	Tenable Cloud Security	SCA Checks	Local	high
443254	SCA: security update for io.netty:netty-handler (GHSA-c653-97m9-rcg9)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
320924	Linux Distros Unpatched Vulnerability : CVE-2026-50010	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-50010

high

Tenable Plugins

high

critical

critical

critical

critical

critical

critical

critical

high

high

critical

critical

high

high

high

high