When curl is told to use the Certificate Status Request TLS extension, often referred to as *OCSP stapling*, to verify that the server certificate is valid, it fails to detect OCSP problems and instead wrongly consider the response as fine.

An update of the curl package has been released.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e691fbbfe7 advisory.

    - Fix trailing dot domain super cookie (CVE-2026-8924)
    - Fix SSH improper host validation (CVE-2026-9547)
    - Fix password leak with netrc and user in URL (CVE-2026-8926)
    - Fix cross-origin Digest auth state leak (CVE-2026-11856)
    - Fix cross-proxy Digest auth state leak (CVE-2026-7168)
    - Fix OCSP stapling bypass with Apple SecTrust (CVE-2026-7009)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tenable Identity Exposure running on the remote host is prior to 3.93.5. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2026-16:

  - Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose     sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user     accounts, and directory settings to unauthenticated remote attackers. Affected responses are served with     Cache-Control: public headers and without Vary: Cookie, allowing reverse proxies and CDNs to cache and     serve sensitive data to unauthenticated users even after authentication is applied. (CVE-2026-13007)

  - Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows     an authorized attacker to bypass a security feature over a network. (CVE-2025-55315)

  - Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer     overflow on 32 bit platforms. A heap buffer overflow may lead to a crash or possibly an attacker     controlled code execution or other undefined behavior. (CVE-2026-31789)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of curl installed on the remote host is 8.17.0 prior to 8.20.0. It is, therefore, affected by an OCSP stapling bypass vulnerability:

  - When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP     stapling, to verify that the server certificate is valid, it fails to detect OCSP problems and instead     wrongly consider the response as fine. This flaw only manifests when curl is built with an OpenSSL-based     backend while running on Apple operating systems with Apple SecTrust enabled. (CVE-2026-7009)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
333770	Photon OS 5.0: Curl PHSA-2026-5.0-91-0856	Nessus	PhotonOS Local Security Checks	Local	medium
331599	Fedora 44 : curl (2026-e691fbbfe7)	Nessus	Fedora Local Security Checks	Local	medium
322483	Tenable Identity Exposure < 3.93.5 Multiple Vulnerabilities (TNS-2026-16)	Nessus	Misc.	Combined	high
318364	Photon OS 5.0: Curl PHSA-2026-5.0-0856	Nessus	PhotonOS Local Security Checks	Local	medium
311424	Curl 8.17.0 < 8.20.0 OCSP Stapling Bypass	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-7009

medium

Tenable Plugins

medium

medium

high

medium

medium