The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets     while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the     lifetime of the connection. Impact summary: A remote peer that can complete a QUIC handshake can cause     connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially     with sustained traffic or many concurrent QUIC connections. CWE: CWE-770: Allocation of Resources Without     Limits or Throttling Description: When the OpenSSL QUIC stack sends an ACK-only packet, there is no     requirement by the QUIC protocol that the peer will acknowledge that ACK-only packet (i.e. it is itself     not ack-eliciting). However, the OpenSSL implementation stores the metadata about the ACK frames     regardless. In and of itself that's ok, but if a malicious peer establishes a connection, and then drives     the connection such that ACK-only packets are forced from the OpenSSL implementation peer (i.e., by     sending numerous PING frames), and then withholding any subsequent acks for ack-eliciting data, like     legitimate data, said malicious peer can force inappropriate memory growth on the OpenSSL peer,     potentially leading to a Denial of Service. The fix is to ensure that we account for the transmission of     the ACK-only packet in the packet histories high and low watermark without actually storing the ACK-only     packet metadata itself. FIPS impact: no The OpenSSL FIPS module is not affected as the QUIC code is     outside the FIPS module boundary. (CVE-2026-63075)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-63075

high Nessus Plugin ID 339519

Version 1.6

Version 1.5

Version 1.4

Version 1.2

Version 1.1

Version 1.6 Sep 14, 2026, 6:39 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609141839
Version 1.5 Sep 13, 2026, 8:08 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609132008
Version 1.4 Aug 29, 2026, 12:30 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608290030
Version 1.2 Aug 26, 2026, 1:14 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608261314
Version 1.1 Aug 26, 2026, 3:06 AM New Plugin Feed: 202608260306