Detections
Analytics
FreeBSD : OpenResty -- multiple vulnerabilities in the bundled nginx core (4d4c2b6e-d433-11f1-a215-a0369f7f7be0)
critical Nessus Plugin ID 374534
Synopsis
The remote FreeBSD host is missing one or more security-related updates.Description
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 4d4c2b6e-d433-11f1-a215-a0369f7f7be0 advisory.The OpenResty developers report:
The nginx core was upgraded from nginx 1.31.1 to 1.31.8, which incorporates 12 CVE fixes, grouped by the first fixed version:
1.31.2: HTTP/3 use-after-free (CVE-2026-42530), HTTP/2 and gRPC upstream buffer overflow (CVE-2026-42055), and charset conversion buffer overread (CVE-2026-48142); 1.31.3: buffer overflow involving map and regex (CVE-2026-42533), memory disclosure involving slice or background cache updates (CVE-2026-60005), and SSI use-after-free (CVE-2026-56434); 1.31.6: HTTP/3 heap buffer overflow with certain OpenSSL versions and configurations (CVE-2026-90439); 1.31.7: buffer overflow involving alias and rewrite (CVE-2026-15176), buffer overflow during variable expression evaluation (CVE-2026-93479), HTTP/3 request body injection (CVE-2026-95101), TLS session ticket forgery (CVE-2026-97629), and AIO and SSI use-after-free (CVE-2026-97205).
Tenable has extracted the preceding description block directly from the FreeBSD security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected packages.See Also
https://nginx.org/en/security_advisories.html
Plugin Details
Severity: Critical
ID: 374534
File Name: freebsd_pkg_4d4c2b6ed43311f1a215a0369f7f7be0.nasl
Version: 1.1
Type: Local
Family: FreeBSD Local Security Checks
Published: 10/31/2026
Updated: 10/31/2026
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.9
Percentile: 99.32
CVSS v2
Risk Factor: High
Base Score: 8.5
Temporal Score: 7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:C
CVSS Score Source: CVE-2026-60005
CVSS v3
Risk Factor: High
Base Score: 8.1
Temporal Score: 7.5
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
CVSS Score Source: CVE-2026-97205
CVSS v4
Risk Factor: Critical
Base Score: 9.2
Threat Score: 8.2
Threat Vector: CVSS:4.0/E:P
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score Source: CVE-2026-97205
Vulnerability Information
CPE: cpe:/o:freebsd:freebsd, p-cpe:/a:freebsd:freebsd:openresty
Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 10/30/2026
Vulnerability Publication Date: 6/17/2026
Reference Information
CVE: CVE-2026-15176, CVE-2026-42055, CVE-2026-42530, CVE-2026-42533, CVE-2026-48142, CVE-2026-56434, CVE-2026-60005, CVE-2026-90439, CVE-2026-93479, CVE-2026-95101, CVE-2026-97205, CVE-2026-97629