The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4571 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4571-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     May 08, 2026                                  https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : apache2     Version        : 2.4.67-1~deb11u1     CVE ID         : CVE-2026-24072 CVE-2026-28780 CVE-2026-29168 CVE-2026-29169                      CVE-2026-33006 CVE-2026-33007 CVE-2026-33523 CVE-2026-33857                      CVE-2026-34032 CVE-2026-34059     Debian Bug     : 1135737

    Multiple vulnerabilities have been discovered in the Apache HTTP server,     which may result in remote code execution, privilege escalation, denial     of service or information disclosure.

    An erratum was issued because DLA??4571??1 incorrectly marked CVE??2026??28780     and CVE??2026??29168 as not fixed.

    These two vulnerabilities are in fact addressed in version 2.4.67??1~deb11u1,     which includes the required security fixes.

    Additionally, CVE??2026??23918 was marked as not affecting Bullseye, as the     vulnerable code is not present in any previously released Bullseye packages.
    However, the updated package includes the fix for this issue as well,     even though it does not impact this release.

    For Debian 11 bullseye, these problems have been fixed in version     2.4.67-1~deb11u1.

    We recommend that you upgrade your apache2 packages.

    For the detailed security status of apache2 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/apache2

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-4571 : apache2 - security update

critical Nessus Plugin ID 313221

Version 1.2

Version 1.1

Version 1.2 May 15, 2026, 12:01 PM CVE (set "CVE" coverage to "CVE-2026-24072,CVE-2026-28780,CVE-2026-29168,CVE-2026-29169,CVE-2026-33006,CVE-2026-33007,CVE-2026-33523,CVE-2026-33857,CVE-2026-34032,CVE-2026-34059") CVSS metrics ("CVSSv2 score" set to 10.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSS metrics ("CVSSv3 score" set to 9.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H") CVSSv2 score source (changed from "CVE-2026-24072" to "CVE-2026-28780") Plugin metadata Plugin Feed: 202605151201
Version 1.1 May 8, 2026, 8:04 PM New Plugin Feed: 202605082004