The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY     decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER     data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET     STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it     also accepts constructed character strings such as UTF8String without a schema, even though those     encodings are not valid DER. The separate indefinite-length ANY path is reachable in BER and CER when     asn1Spec selects univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder uses growing header     concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly     copying an increasing prefix and causing quadratic work. A sufficiently fragmented value can occupy     decoding workers and cause CPU exhaustion without confidentiality or integrity impact. This issue is fixed     in version 0.6.5. (CVE-2026-119195)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-119195

high Nessus Plugin ID 374123

Version 1.3

Version 1.2

Version 1.3 Oct 31, 2026, 7:06 PM CVSS metrics ("CVSSv2 score" set to 6.4) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610311906
Version 1.2 Oct 30, 2026, 9:10 PM Detection (updated detection logic) New Plugin metadata Plugin Feed: 202610302110