The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced     to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of     the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data received. Impact     summary: A remote attacker able to spoof packets to a server using the OpenSSL QUIC implementation might     use the server for an amplification of a DDoS attack. CWE: CWE-440: Expected Behavior Violation     Description: OpenSSL's QUIC stack, when operating as a server, enforces client address validation (RFC     9000, Section 8), to confirm the peer address is not used for a traffic amplification attack. If this     feature is disabled on the server, the QUIC stack limits the amount of server data that can be sent to 3     times the amount of data received from the peer address, until such time as the TLS handshake is     completed. The OpenSSL QUIC server, when operating in non-validation mode, adds the length of the whole     datagram received to the unvalidated credit limit when processing each QUIC packet in the datagram. A     remote peer may, after establishing a connection with an initial client hello frame, send a subsequent     datagram containing multiple QUIC packets, leading the server to account the entire datagram length for     each packet in the datagram, resulting in the server believing that the peer has sent more data than it     actually has, thereby violating the 3x amplification limit mandated by the RFC. FIPS impact: no As the     QUIC stack lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.
    (CVE-2026-35191)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-35191

low Nessus Plugin ID 351168

Version 1.5

Version 1.3

Version 1.2

Version 1.1

Version 1.5 Oct 9, 2026, 2:01 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610091401
Version 1.3 Sep 30, 2026, 4:36 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609301636
Version 1.2 Sep 30, 2026, 6:31 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609300631
Version 1.1 Sep 30, 2026, 1:44 AM New Plugin Feed: 202609300144