The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db     modules) allows DNS Cache Poisoning. The built-in DNS resolver (inet_res) uses a sequential, process-     global 16-bit transaction ID for UDP queries and does not implement source port randomization. Response     validation relies almost entirely on this ID, making DNS cache poisoning practical for an attacker who can     observe one query or predict the next ID. This conflicts with RFC 5452 recommendations for mitigating     forged DNS answers. inet_res is intended for use in trusted network environments and with trusted     recursive resolvers. Earlier documentation did not clearly state this deployment assumption, which could     lead users to deploy the resolver in environments where spoofed DNS responses are possible. This     vulnerability is associated with program files lib/kernel/src/inet_db.erl and lib/kernel/src/inet_res.erl.
    This issue affects OTP from OTP 17.0 until OTP 28.4.2, 27.3.4.10 and 26.2.5.19 corresponding to kernel     from 3.0 until 10.6.2, 10.2.7.4 and 9.2.4.11. (CVE-2026-28810)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-28810

medium Nessus Plugin ID 305613

Version 1.3