The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(),     lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack     buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-     length, server-determined data into a buffer of unspecified size. Because both the \lo_export command in     psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory. Versions     before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected. (CVE-2026-6477)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-6477

high Nessus Plugin ID 314713

Version 1.5

Version 1.4

Version 1.1

Version 1.5 Jun 4, 2026, 6:01 AM CVSS metrics ("CVSSv2 score" set to 9.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202606040601
Version 1.4 May 25, 2026, 10:30 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202605252230
Version 1.1 May 15, 2026, 12:01 PM New Plugin Feed: 202605151201