The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an     untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix     deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with     HEX_MIRROR_URL, HEX_MIRROR or mirror_url as untrusted: it doesn't send credentials to it, and it checks     registry signatures and package checksums that the mirror can't forge. Several response paths consume     memory or disk in proportion to what the mirror sends before any of those checks run. Hex.HTTP.request/5     reads the whole response body into memory and decompresses it with :zlib.gunzip/1 whenever the response's     Content-Encoding contains gzip, with no limit on the compressed or decompressed size. Hex doesn't ask for     compressed responses, so the server decides whether this step runs. It applies to registry, package, docs     and API responses. Package tarballs have no download size limit. Hex 2.5.1 holds the whole tarball in     memory and writes it to the cache, and the development branch streams it to a temporary file; the 16 MiB     tarball limit is checked only when the file is unpacked. The tarball is then unpacked, into deps/<app> in     2.5.1 and into a staging directory on the development branch, before its checksums are compared with the     registry. mix hex.docs fetch, and mix hex.docs offline when docs are missing, write the docs tarball to     disk and extract it with :mix_hex_erl_tar.extract/2 without the 16 MiB compressed and 128 MiB decompressed     limits that mix_hex_tarball:unpack_docs/3 applies. The signed registry doesn't cover docs tarballs, so     nothing checks them. Registry responses are also decompressed before their signature is checked, in     hex_core code that Hex vendors; that part is tracked in     https://github.com/hexpm/hex_core/security/advisories/GHSA-7c4r-cgf9-9jmq. This issue affects hex: from     0.11.2 before 2.5.2. (CVE-2026-96618)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-96618

low Nessus Plugin ID 366675

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.4 Nov 6, 2026, 2:22 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202611061422
Version 1.3 Oct 23, 2026, 5:56 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610231756
Version 1.2 Oct 20, 2026, 4:30 AM Plugin metadata Detection (updated detection logic) Plugin Feed: 202610200430
Version 1.1 Oct 17, 2026, 4:43 AM New Plugin Feed: 202610170443