The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read     files inside a mod_auth protected directory by prefixing the request path with an extra slash.
    httpd_request:validate_uri/1 normalises the request URI with uri_string:normalize/1, which performs RFC     3986 dot-segment removal but does not collapse empty path segments, so a doubled slash survives.
    mod_alias:real_name/3 concatenates the document root with that URI, and mod_auth:secret_path/3 then     decides whether the result lies inside a protected directory block by running the configured directory     path as an unanchored regular expression against it. The doubled slash breaks the contiguous substring the     regex needs, so the request is treated as unprotected and no authentication challenge is issued, while     mod_get opens the same path and the operating system collapses the doubled slash and returns the protected     file. The same path mismatch also evades the per-path accounting in mod_security. This issue affects OTP     from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP     29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before     9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
    (CVE-2026-66835)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-66835

high Nessus Plugin ID 342478

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Sep 18, 2026, 12:24 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609180024
Version 1.2 Sep 3, 2026, 6:34 PM CVSS metrics ("CVSSv2 score" set to 5.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609031834
Version 1.1 Sep 3, 2026, 7:44 AM New Plugin Feed: 202609030744