When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4048-1 advisory.

    - CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass (bsc#1277476).
    - CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free (bsc#1277479).
    - CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated connections to succeed (bsc#1277480).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4047-1 advisory.

    - CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).
    - CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).
    - CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).
    - CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass (bsc#1277476).
    - CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free (bsc#1277479).
    - CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated connections to succeed (bsc#1277480).

    Changes for curl:

    - Call http_size() first to prioritize Transfer-Encoding: chunked over a zero      Content-Length empty body check (bsc#1264971)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4071-1 advisory.

    - CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass (bsc#1277476).
    - CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free (bsc#1277479).
    - CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated connections to succeed (bsc#1277480).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21774-1 advisory.

    - CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).
    - CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).
    - CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).
    - CVE-2026-13608: OpenLDAP SASL authentication bypass (bsc#1277476).
    - CVE-2026-80229: OpenSSL provider use-after-free (bsc#1277479).
    - CVE-2026-80230: OpenSSL pinning bypass (bsc#1277480).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When performing transfers via libcurl's multi interface, pooled TLS connections can outlive their     originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library     context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference;
    destroying the easy handle prematurely frees this context while the active connection retains a dangling     pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.
    (CVE-2026-80229)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
348465	SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2026:4048-1)	Nessus	SuSE Local Security Checks	Local	high
348459	SUSE SLES15 Security Update : curl (SUSE-SU-2026:4047-1)	Nessus	SuSE Local Security Checks	Local	high
348430	SUSE SLES12 Security Update : curl (SUSE-SU-2026:4071-1)	Nessus	SuSE Local Security Checks	Local	high
343957	openSUSE 16: curl / curl-fish-completion / curl-zsh-completion / libcurl-devel / etc (openSUSE-SU-2026:21774-1)	Nessus	SuSE Local Security Checks	Local	high
342507	Linux Distros Unpatched Vulnerability : CVE-2026-80229	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-80229

high

Tenable Plugins

high

high

high

high

high