The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh     (ssh_transport modules) allows Denial of Service via Resource Depletion. The SSH transport layer     advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication     without any size limit, enabling reliable memory exhaustion DoS. Two compression algorithms are affected:
    * zlib: Activates immediately after key exchange, enabling unauthenticated attacks * zlib@openssh.com:
    Activates post-authentication, enabling authenticated attacks Each SSH packet can decompress ~255 MB from     256 KB of wire data (1029:1 amplification ratio). Multiple packets can rapidly exhaust available memory,     causing OOM kills in memory-constrained environments. This vulnerability is associated with program files     lib/ssh/src/ssh_transport.erl and program routines ssh_transport:decompress/2,     ssh_transport:handle_packet_part/4. This issue affects OTP from OTP 17.0 until OTP 28.4.1, 27.3.4.9 and     26.2.5.18 corresponding to ssh from 3.0.1 until 5.5.1, 5.2.11.6 and 5.1.4.14. (CVE-2026-23943)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-23943

medium Nessus Plugin ID 302364

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Mar 22, 2026, 11:25 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202603221125
Version 1.2 Mar 18, 2026, 7:26 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202603181926
Version 1.1 Mar 16, 2026, 4:14 AM New Plugin Feed: 202603160414