The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786360814 advisory.

  - Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol     suite. In versions up to and including 0.9-rc5, the simple protocol server ignores the documented client     limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` is defined,     `server_work()` unconditionally `accept()`s and `client_new()` always appends the new client and     increments `n_clients`. There is no check against the limit. When client cannot be accepted as a result of     maximal socket number of avahi-daemon, it logs unconditionally error per each connection. Unprivileged     local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for     mDNS/DNS-SD. Exhausting local file descriptors causes increased system load caused by logging errors of     each of request. Overloading prevents glibc calls using nss-mdns plugins to resolve `*.local.` names and     link-local addresses. As of time of publication, no known patched versions are available, but a candidate     fix is available in pull request 808, and some workarounds are available. Simple clients are offered for     nss-mdns package functionality. It is not possible to disable the unix socket `/run/avahi-daemon/socket`,     but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-     address and avahi-resolve-host-name are not affected, they use DBus interface. It is possible to change     permissions of unix socket after avahi-daemon is started. But avahi-daemon does not provide any     configuration for it. Additional access restrictions like SELinux can also prevent unwanted tools to     access the socket and keep resolution working for trusted users. (CVE-2025-59529)

  - Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol     suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing     CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-     daemon crashes. (CVE-2025-68468)

  - Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol     suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with     CNAME resource records 2 seconds apart. (CVE-2025-68471)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

AlmaLinux 9.2 [TuxCare] Security Update: avahi / avahi-autoipd / avahi-compat-howl / avahi-compat-howl-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1786360814)

medium Nessus Plugin ID 352013

Version 1.2

Version 1.1

Version 1.2 Oct 24, 2026, 10:32 AM CVE (set "CVE" coverage to "CVE-2025-59529,CVE-2025-68468,CVE-2025-68471") CVSS metrics ("CVSSv2 score" set to 7.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C") CVSS metrics ("CVSSv3 score" set to 6.5) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H") CVSSv2 score source (changed from "CVE-2025-59529" to "CVE-2025-68471") CVSSv2 severity (based on CVE-2025-68471, severity increased from "Medium" to "High") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610241032
Version 1.1 Sep 30, 2026, 9:32 PM New Plugin Feed: 202609302132