There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason
    `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.
    (CVE-2026-92392)

  - Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations
    and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-
    SHA256` header to whatever URL isset next, leaking state information. (CVE-2026-86409)

  - A flaw in the curl command line tool's logic makes it only set SSH host verification options when
    interacting directly using SFTP or SCP, and not as a result of following a redirect. (CVE-2026-86410)

  - An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a
    previous easy handle upgraded with `STARTTLS` and authenticated using a client certificate. The second
    handle performs neither a new TLS handshake nor a new FTP login, so the server continues to authorize it
    under the first handle's certificate identity. (CVE-2026-86411)

  - A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot
    reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before
    connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies for unrelated
    domains. (CVE-2026-86412)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - 處理 HTTP 重新導向至包含 userinfo （「username：password」元件） 的 URL 時，curl 可能會錯誤地保留並重新傳輸原始主機的 HTTP 協商驗證狀態。
    因此，惡意伺服器可觸發包含任意使用者資訊的重新導向，以強制 curl 將使用用戶端處理程序環境身分產生的新 Kerberos 票證傳送至不受信任的第三方主機，有效地繞過通常因缺少「」--location-trusted而強制執行的網域範圍限制。（CVE-2026-94265）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 处理 HTTP 重定向到包含 userinfo（一个“username：password”组件）的 URL 时，curl 可能会错误地保留并重新传输原始主机的 HTTP 协商认证状态。
    因此，恶意服务器可触发包含任意 userinfo 的重定向，以强制 curl 将使用客户端进程的环境身份生成的、新生成的 Kerberos 票证发送到不受信任的第三方主机，有效绕过通常因缺少“”--location-trusted而强制实施的域范围限制。（CVE-2026-94265）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - ユーザー情報を含む URL(「username:password」コンポーネント)への HTTP リダイレクトを処理する際に、curl が誤って元のホストの HTTP ネゴシエート認証状態を保持して再送信する可能性があります。
    結果として、悪意のあるサーバーが、任意のユーザー情報を含むリダイレクトを発生させ、クライアントプロセスのアンビエント ID を使用して生成された新しく作成された Kerberos チケットを、信頼できないサードパーティのホストに送信するよう curl に強制する可能性があります。これは、「--location-trusted」がないことで通常強制されるドメインスコーピング制限を効果的にバイパスします。(CVE-2026-94265)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

リモートホストにインストールされている FreeBSD のバージョンは、テスト済みバージョンより前です。したがって、14dab969-c797-11f1-a6ea-8447094a420f のアドバイザリに記載されている複数の脆弱性の影響を受けます。

    Curl プロジェクトによる報告:

Tenable は、前述の記述ブロックを FreeBSD セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5069-1 advisory.

    - CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
    - CVE-2026-9546: sending old referer (bsc#1268419).
    - CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (bsc#1268423).
    - CVE-2026-11564: Native CA trust persist (bsc#1268424).
    - CVE-2026-11586: WS Auto-PONG memory exhaustion (bsc#1268425).
    - CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
    - CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
    - CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
    - CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
    - CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
    - CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
    - CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
    - CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
    - CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029).
    - CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028).
    - CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027).
    - CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
    - CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024).
    - CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
    - CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
    - CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
    - CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
    - CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
    - CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
    - CVE-2026-92389: TFTP direction confusion (bsc#1285015).
    - CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
    - CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
    - CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
    - CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011).
    - CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
    - CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).

    Changes for curl:

    - Updated to version 8.22.0. (jsc#PED-16984)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 14dab969-c797-11f1-a6ea-8447094a420f advisory.

    The Curl project reports:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5068-1 advisory.

    - CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
    - CVE-2026-9546: sending old referer (bsc#1268419).
    - CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (bsc#1268423).
    - CVE-2026-11564: Native CA trust persist (bsc#1268424).
    - CVE-2026-11586: WS Auto-PONG memory exhaustion (bsc#1268425).
    - CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
    - CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
    - CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
    - CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
    - CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
    - CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
    - CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
    - CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
    - CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029).
    - CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028).
    - CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027).
    - CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
    - CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024).
    - CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
    - CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
    - CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
    - CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
    - CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
    - CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
    - CVE-2026-92389: TFTP direction confusion (bsc#1285015).
    - CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
    - CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
    - CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
    - CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011).
    - CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
    - CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).

    Changes for curl:

    - Updated curl to version 8.22.0. (jsc#PED-16984)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl     might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state.
    Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl to     send a freshly minted Kerberos ticketgenerated using the ambient identity of the client process to an     untrusted third-party host, effectively bypassing the domain-scoping restrictions normally enforced by the     absence of `--location-trusted`. (CVE-2026-94265)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
477458	Alpine: libcurl, multiple curl packages: security update to 8.23.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	10/25/2026	11/2/2026	critical
477458	Alpine: libcurl, multiple curl packages: security update to 8.23.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	10/25/2026	11/2/2026	critical
365687	Linux Distros 未修補弱點：CVE-2026-94265	Nessus	Misc.	10/14/2026	11/2/2026	critical
365687	Linux Distros 未修补的漏洞：CVE-2026-94265	Nessus	Misc.	10/14/2026	11/2/2026	critical
365687	Linux Distros のパッチ未適用の脆弱性: CVE-2026-94265	Nessus	Misc.	10/14/2026	11/2/2026	critical
365567	FreeBSD:curl -- 複数の脆弱性(14dab969-c797-11f1-a6ea-8447094a420f)	Nessus	FreeBSD Local Security Checks	10/14/2026	11/2/2026	critical
376286	SUSE SLES15 Security Update : curl (SUSE-SU-2026:5069-1)	Nessus	SuSE Local Security Checks	11/5/2026	11/5/2026	critical
365567	FreeBSD : Curl -- Multiple vulnerabilities (14dab969-c797-11f1-a6ea-8447094a420f)	Nessus	FreeBSD Local Security Checks	10/14/2026	11/2/2026	critical
376257	SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2026:5068-1)	Nessus	SuSE Local Security Checks	11/5/2026	11/5/2026	critical
365687	Linux Distros Unpatched Vulnerability : CVE-2026-94265	Nessus	Misc.	10/14/2026	11/2/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical