The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1,     the nghttp2 library stops reading the incoming data when user facing public API     `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application.
    They might be called internally by the library when it detects the situation that is subject to connection     error. Due to the missing internal state validation, the library keeps reading the rest of the data after     one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes     assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known     workarounds are available. (CVE-2026-27135)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-27135

high Nessus Plugin ID 302948

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Mar 21, 2026, 9:15 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202603210915
Version 1.2 Mar 20, 2026, 2:56 AM CVSS metrics ("CVSSv2 score" set to 5.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P") CVSSv2 severity (based on CVE-2026-27135, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202603200256
Version 1.1 Mar 19, 2026, 12:10 PM New Plugin Feed: 202603191210