The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body     directly to the connection without framing after the request headers. If the server rejects the CONNECT     request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because     CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a     subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and     causing the next caller that reuses it to read the response to the injected request. In reverse proxies     (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead     to cross-user response poisoning. (CVE-2026-56866)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-56866

high Nessus Plugin ID 364309

Version 1.2

Version 1.1

Version 1.2 Oct 10, 2026, 5:24 AM CVSS metrics ("CVSSv2 score" set to none) CVSS metrics ("CVSSv2 vector" set to none) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N") CVSS temporal metrics ("CVSSv2 temporal vector" set to none) CVSSv2 severity (based on CVE-2026-56866, severity increased from "Medium" to "High") CVSSv3 score source (set to "CVE-2026-56866") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610100524
Version 1.1 Oct 9, 2026, 2:01 PM New Plugin Feed: 202610091401