The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its     cached extension data to be freed while another thread is still using it. Impact summary: A remote,     unauthenticated peer could crash a multi-threaded TLS client, or a multi-threaded TLS server that requests     client certificates, if the first certificate chains built to the same trusted CA certificate are built by     several connections at the same time. This is a use-after-free read, which is likely to crash the process,     resulting in a Denial of Service. CWE: CWE-416: Use After Free Description: OpenSSL caches the decoded     values of a certificate's X.509v3 extensions inside the X509 object the first time they are needed. In     OpenSSL 4.0 this cache is built in two phases: the extension values are computed while holding a read lock     on the certificate, and the results are then installed into the certificate under a write lock. Because a     read lock does not exclude other readers, several threads can compute the cache for the same certificate     at the same time. Each thread that subsequently acquires the write lock installs its own results and frees     the values installed by the thread before it, even though that earlier thread has already marked the cache     as complete and may have returned pointers into it to its caller. A caller still using those pointers then     reads freed memory. Any certificate shared between threads is exposed the first time its extensions are     decoded. In TLS the certificates at risk are the trusted CA certificates supplied for chain verification,     by whatever means, since these are shared by every connection and their extensions are decoded and cached     the first time a chain is built to them. Certificates sent by the peer are decoded separately for each     connection and are not shared, so they are not affected. In a TLS client verifying server certificates, or     a TLS server that requests and verifies client certificates, the use-after-free could only occur if the     first chains built to the same trusted CA are built by several connections at the same time. FIPS impact:
    no The FIPS module is not affected as X.509 certificate handling is outside of the OpenSSL FIPS module     boundary. OpenSSL 4.0 is vulnerable to this issue. OpenSSL 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are not     affected by this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.3. This issue was reported on 27     August 2026 by Tim Becker (Xint.io) and independently in a public report on 31 August 2026 by aydinmercan.
    The fix has been developed by Bob Beck. -- cut (non-publishing metadata for internal use) -- Reported by:
    Tim Becker (Xint.io), aydinmercan Fixed by: Bob Beck (CVE-2026-84783)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-84783

high Nessus Plugin ID 351203

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.5 Nov 6, 2026, 7:31 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202611060731
Version 1.4 Nov 5, 2026, 1:24 AM Detection (updated detection logic) Plugin Feed: 202611050124
Version 1.3 Oct 9, 2026, 2:01 PM Detection (updated detection logic) Plugin Feed: 202610091401
Version 1.2 Sep 30, 2026, 6:31 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609300631
Version 1.1 Sep 30, 2026, 1:44 AM New Plugin Feed: 202609300144