The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libceph: Use u32 for non-negative values in ceph_monmap_decode() This patch fixes unnecessary implicit     conversions that change signedness of blob_len and num_mon in ceph_monmap_decode(). Currently blob_len and     num_mon are (signed) int variables. They are used to hold values that are always non-negative and get     assigned in ceph_decode_32_safe(), which is meant to assign u32 values. Both variables are subsequently     used as unsigned values, and the value of num_mon is further assigned to monmap->num_mon, which is of type     u32. Therefore, both variables should be of type u32. This is especially relevant for num_mon. If the     value read from the incoming message is very large, it is interpreted as a negative value, and the check     for num_mon > CEPH_MAX_MON does not catch it. This leads to the attempt to allocate a very large chunk of     memory for monmap, which will most likely fail. In this case, an unnecessary attempt to allocate memory is     performed, and -ENOMEM is returned instead of -EINVAL. (CVE-2026-43405)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-43405

high Nessus Plugin ID 313383

Version 1.2

Version 1.1

Version 1.2 May 9, 2026, 8:04 AM CVSS metrics ("CVSSv2 score" set to 6.2) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C") CVSS metrics ("CVSSv3 score" set to 7.1) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H") CVSSv2 severity (based on CVE-2026-43405, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202605090804
Version 1.1 May 9, 2026, 2:20 AM New Plugin Feed: 202605090220