The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791281631 advisory.

  - The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer     overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away,     a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes     into it, producing a heap buffer overflow. (CVE-2025-14181)

  - phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The     field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently     wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file     content as the next TAR header, which lets a crafted archive inject entries that PharData reports and     extracts as if they were genuine. (CVE-2026-6103)

  - cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An     unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any     SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the     SOAP value decoder and in the WSDL node search helper. (CVE-2026-91765)

  - When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and     Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different     port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials     that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0     ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f ). (CVE-2026-91766)

  - php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to     memchr() when a TLS server certificate presents a wildcard name whose literal characters are together     longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP     client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default     client stream, because verify_peer_name is enabled by default. (CVE-2026-91767)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

AlmaLinux 9.6 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791281631)

medium Nessus Plugin ID 363134

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Oct 26, 2026, 2:57 PM CVSS metrics ("CVSSv2 score" set to 5.4) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:H/Au:N/C:C/I:N/A:N") CVSS metrics ("CVSSv3 score" set to 5.9) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") CVSSv2 score source (changed from "CVE-2026-91768" to "CVE-2026-91766") Exploit attributes ("Exploit available" set to "True") Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202610261457
Version 1.2 Oct 10, 2026, 5:24 AM Plugin metadata (Add IAVM Info) Plugin Feed: 202610100524
Version 1.1 Oct 6, 2026, 7:18 PM New Plugin Feed: 202610061918