The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated     HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse     an existing connection to avoid overhead. When reusing a connection a range of criterion must first be     met. Due to a logical error in the code, a request that was issued by an application could wrongfully     reuse an existing connection to the same server that was authenticated using different credentials. One     underlying reason being that Negotiate sometimes authenticates *connections* and not *requests*, contrary     to how HTTP is designed to work. An application that allows Negotiate authentication to a server (that     responds wanting Negotiate) with `user1:password1` and then does another operation to the same server also     using Negotiate but with `user2:password2` (while the previous connection is still alive) - the second     request wrongly reused the same connection and since it then sees that the Negotiate negotiation is     already made, it just sends the request over that connection thinking it uses the user2 credentials when     it is in fact still using the connection authenticated for user1... The set of authentication methods to     use is set with `CURLOPT_HTTPAUTH`. Applications can disable libcurl's reuse of connections and thus     mitigate this problem, by using one of the following libcurl options to alter how connections are or are     not reused: `CURLOPT_FRESH_CONNECT`, `CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using     the curl_multi API). (CVE-2026-1965)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-1965

medium Nessus Plugin ID 301847

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.5 Mar 18, 2026, 7:26 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202603181926
Version 1.4 Mar 17, 2026, 4:16 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202603171616
Version 1.3 Mar 14, 2026, 2:09 AM CVSS metrics ("CVSSv2 score" set to 5.5) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N") CVSSv2 severity (based on CVE-2026-1965, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202603140209
Version 1.2 Mar 12, 2026, 10:32 AM CVSS metrics ("CVSSv3 score" set to 6.5) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N") CVSSv3 severity (based on None, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202603121032
Version 1.1 Mar 11, 2026, 10:59 PM New Plugin Feed: 202603112259