The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause     excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-     encoded HEADERS frame that decodes into a large trailer field section with many unique field names and/or     large values. The implementation builds an `http.Header` for the corresponding `http.Request` or     `http.Response`, while only enforcing limits on the size of the QPACK-compressed HEADERS frame, not on the     decoded field section. This can lead to memory exhaustion. This is very similar to CVE-2025-64702. The     difference is that this issue uses HTTP trailers, rather than HTTP headers, as the attack vector. A     misbehaving or malicious peer can cause a denial-of-service (DoS) attack against quic-go's HTTP/3 servers     or clients by triggering excessive memory allocation, potentially leading to crashes or resource     exhaustion. This affects both servers and clients due to symmetric header construction. Version 0.59.1     enforces RFC 9114 decoded field section size limits for trailers as well. It incrementally decodes QPACK     entries and checks the field section size after each entry, aborting the stream if an entry causes the     limit to be exceeded. (CVE-2026-40898)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-40898

medium Nessus Plugin ID 318811

Version 1.2

Version 1.1

Version 1.2 Jun 6, 2026, 1:00 AM CVSS metrics ("CVSSv2 score" set to 5.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P") Detection (updated detection logic) Plugin metadata Plugin Feed: 202606060100
Version 1.1 Jun 5, 2026, 7:13 PM New Plugin Feed: 202606051913