The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S)     request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of     recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When     reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that     was issued by an application could wrongfully reuse an existing connection to the same server that was     authenticated using different credentials. An application that first uses Negotiate authentication to a     server with `user1:password1` and then does another operation to the same server asking for any     authentication method but for `user2:password2` (while the previous connection is still alive) - the     second request gets confused and wrongly reuses the same connection and sends the new request over that     connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the     connection authenticated for user1... (CVE-2026-5545)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-5545

medium Nessus Plugin ID 311003

Version 1.8

Version 1.5

Version 1.4

Version 1.3

Version 1.1

Version 1.8 May 15, 2026, 12:01 PM CVSS metrics ("CVSSv2 score" set to 6.1) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:H/Au:N/C:P/I:C/A:N") Plugin Feed: 202605151201
Version 1.5 May 11, 2026, 11:42 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202605111142
Version 1.4 May 5, 2026, 10:13 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202605052213
Version 1.3 May 1, 2026, 7:22 AM CVSS metrics ("CVSSv3 score" set to 8.8. "CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N". "CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H") CVSSv2 severity (based on CVE-2026-5545, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202605010722
Version 1.1 Apr 30, 2026, 3:55 AM New Plugin Feed: 202604300355