The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails     for initial packet. Impact summary: Double free leads to heap corruption, which typically results in     termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this     double free is exploitable for remote code execution, thus it is considered highly improbable. CWE:
    CWE-415: Double Free Description: In order to validate initial packet, OpenSSL QUIC stack default packet     handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates     successfully with QRX object, the default packet handler proceeds to channel (connection object) creation.
    The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the     newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once     port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the     error branch, where the same QRX object is freed for the second time. The failure in port_bind_channel()     function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL     packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then     port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has     invalid length. FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of     the OpenSSL FIPS module boundary. (CVE-2026-18798)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-18798

high Nessus Plugin ID 339477

Version 1.2

Version 1.2

Version 1.1

Version 1.2 Aug 26, 2026, 8:10 AM CVSS metrics ("CVSSv3 score" set to 7.5) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608260810
Version 1.2 Aug 26, 2026, 1:14 PM CVSS metrics ("CVSSv3 score" set to 7.5. "CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608261314
Version 1.1 Aug 25, 2026, 9:17 PM New Plugin Feed: 202608252117