The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Netty is a network application framework for development of protocol servers and clients.
    NoQuicTokenHandler is the tokenHandler used when the application does not set one. Prior to version     4.2.15.Final, its writeToken() returns false (server will not send Retry  acceptable), but     validateToken() unconditionally `return 0`. In QuicheQuicServerCodec.handlePacket(), a non-negative return     from validateToken() is interpreted as 'token is valid, ODCID starts at offset 0', causing the server to     call quiche_accept as if the client's address had been validated by a Retry round-trip. Per RFC 9000 8.1,     a validated address lifts the 3 anti-amplification send limit. Thus any attacker who includes ANY non-     empty token bytes in an Initial packet  with a spoofed victim source IP  causes the Netty server to     treat the victim as validated and reflect full-size handshake flights (certificates, etc.) toward it     without the 3 cap. The correct 'no token handler' semantics would be to return -1 (invalid) so the normal     un-validated path and amplification limit apply. Version 4.2.15.Final patches the issue. (CVE-2026-44894)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-44894

high Nessus Plugin ID 320904

Version 1.6