The version of Azul Zulu installed on the remote host is 6 prior to 6.77.0.12 / 7 prior to 7.83.0.12 / 8 prior to 8.91.0.12 / 11 prior to 11.85.12 / 17 prior to 17.63.12 / 21 prior to 21.47.14 / 25 prior to 25.31.14. It is, therefore, affected by multiple vulnerabilities as referenced in the 2026-01-20 advisory.

  - A flaw was found in how GLib's GString manages memory when adding data to strings. If a string is already     very large, combining it with more input can cause a hidden overflow in the size calculation. This makes     the system think it has enough memory when it doesn't. As a result, data may be written past the end of     the allocated memory, leading to crashes or memory corruption. (CVE-2025-6052)

  - A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations     can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of     service when processing crafted input. (CVE-2025-6021)

  - A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts     internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this     corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory,     causing crashes or enabling attackers to trigger heap corruption. (CVE-2025-7425)

  - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26,     iOS 26 and iPadOS 26. Processing maliciously crafted web content may lead to an unexpected Safari crash.
    (CVE-2025-43368)

  - In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a     heap buffer while parsing an MP4 file, possibly leading to information disclosure. (CVE-2025-47219)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Azul Zulu Java Multiple Vulnerabilities (2026-01-20)

high Nessus Plugin ID 294803

Version 1.2

Version 1.1

Version 1.2 Feb 4, 2026, 2:23 PM CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N") CVSSv2 score source (changed from "CVE-2025-6052" to "CVE-2026-21932") CVSSv3 score source (set to "CVE-2025-6052") Plugin Feed: 202602041423
Version 1.1 Jan 21, 2026, 10:50 AM New Plugin Feed: 202601211050