It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1351 advisory.

    When asked to both use a `.netrc` file for credentials and to follow HTTPredirects, curl could leak the     password used for the first host to thefollowed-to host under certain circumstances.

    This flaw only manifests itself if the netrc file has an entry that matchesthe redirect target hostname     but the entry either omits just the password oromits both login and password. (CVE-2024-11053)

    When asked to use a `.netrc` file for credentials **and** to follow HTTPredirects, curl could leak the     password used for the first host to thefollowed-to host under certain circumstances.

    This flaw only manifests itself if the netrc file has a `default` entry thatomits both login and password.
    A rare circumstance. (CVE-2025-0167)

    predictable WebSocket mask

    NOTE: https://curl.se/docs/CVE-2025-10148.htmlNOTE: Fixed by:
    https://github.com/curl/curl/commit/84db7a9eae8468c0445b15aa806fa7fa806fa0f2 (curl-8_16_0)     (CVE-2025-10148)

    curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed     and missed host verification mechanisms.

    This prevents curl from detecting MITM attackers and more. (CVE-2025-10966)

    Out of bounds read for cookie path

    NOTE: https://curl.se/docs/CVE-2025-9086.htmlNOTE: Introduced with:
    https://github.com/curl/curl/commit/f24dc09d209a2f91ca38d854f0c15ad93f3d7e2d (curl-7_31_0)NOTE: Fixed by:
    https://github.com/curl/curl/commit/c6ae07c6a541e0e96d0040afb62b45dd37711300 (rc-8_16_0-1) (CVE-2025-9086)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2024-0303 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:4359-1 advisory.

    - CVE-2024-11053: Fixed password leak in curl used for the first host to the followed-to host under     certain circumstances (bsc#1234068)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:1671 advisory.

    * openssl: SSL_select_next_proto buffer overread (CVE-2024-5535)
      * krb5: GSS message token handling (CVE-2024-37371)
      * curl: libcurl: ASN.1 date parser overread (CVE-2024-7264)
      * mysql: Thread Pooling unspecified vulnerability (CPU Oct 2024) (CVE-2024-21238)
      * mysql: X Plugin unspecified vulnerability (CPU Oct 2024) (CVE-2024-21196)
      * mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21241)
      * mysql: Client programs unspecified vulnerability (CPU Oct 2024) (CVE-2024-21231)
      * mysql: Information Schema unspecified vulnerability (CPU Oct 2024) (CVE-2024-21197)
      * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21218)
      * mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21201)
      * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21236)
      * mysql: Group Replication GCS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21237)
      * mysql: FTS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21203)
      * mysql: Health Monitor unspecified vulnerability (CPU Oct 2024) (CVE-2024-21212)
      * mysql: DML unspecified vulnerability (CPU Oct 2024) (CVE-2024-21219)
      * mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21230)
      * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21213)
      * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21194)
      * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21199)
      * mysql: PS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21193)
      * mysql: DDL unspecified vulnerability (CPU Oct 2024) (CVE-2024-21198)
      * mysql: mysqldump unspecified vulnerability (CPU Oct 2024) (CVE-2024-21247)
      * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21239)
      * curl: curl netrc password leak (CVE-2024-11053)
      * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21497)
      * mysql: MySQL Server Options Vulnerability (CVE-2025-21520)
      * mysql: High Privilege Denial of Service Vulnerability in MySQL Server (CVE-2025-21490)
      * mysql: Information Schema unspecified vulnerability (CPU Jan 2025) (CVE-2025-21529)
      * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21531)
      * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21504)
      * mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21540)
      * mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability     (CVE-2025-21555)
      * mysql: Packaging unspecified vulnerability (CPU Jan 2025) (CVE-2025-21543)
      * mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability     (CVE-2025-21491)
      * mysql: DDL unspecified vulnerability (CPU Jan 2025) (CVE-2025-21525)
      * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21536)
      * mysql: Thread Pooling unspecified vulnerability (CPU Jan 2025) (CVE-2025-21521)
      * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21501)
      * mysql: Performance Schema unspecified vulnerability (CPU Jan 2025) (CVE-2025-21534)
      * mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21494)
      * mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21519)
      * mysql: Parser unspecified vulnerability (CPU Jan 2025) (CVE-2025-21522)
      * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21503)
      * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21518)
      * mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability     (CVE-2025-21559)
      * mysql: Privilege Misuse in MySQL Server Security Component (CVE-2025-21546)
      * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21500)
      * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21523)
      * mysql: Components Services unspecified vulnerability (CPU Jan 2025) (CVE-2025-21505)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:1671 advisory.

    * openssl: SSL_select_next_proto buffer overread (CVE-2024-5535)

    * krb5: GSS message token handling (CVE-2024-37371)

    * curl: libcurl: ASN.1 date parser overread (CVE-2024-7264)

    * mysql: Thread Pooling unspecified vulnerability (CPU Oct 2024) (CVE-2024-21238)

    * mysql: X Plugin unspecified vulnerability (CPU Oct 2024) (CVE-2024-21196)

    * mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21241)

    * mysql: Client programs unspecified vulnerability (CPU Oct 2024) (CVE-2024-21231)

    * mysql: Information Schema unspecified vulnerability (CPU Oct 2024) (CVE-2024-21197)

    * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21218)

    * mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21201)

    * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21236)

    * mysql: Group Replication GCS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21237)

    * mysql: FTS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21203)

    * mysql: Health Monitor unspecified vulnerability (CPU Oct 2024) (CVE-2024-21212)

    * mysql: DML unspecified vulnerability (CPU Oct 2024) (CVE-2024-21219)

    * mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21230)

    * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21213)

    * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21194)

    * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21199)

    * mysql: PS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21193)

    * mysql: DDL unspecified vulnerability (CPU Oct 2024) (CVE-2024-21198)

    * mysql: mysqldump unspecified vulnerability (CPU Oct 2024) (CVE-2024-21247)

    * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21239)

    * curl: curl netrc password leak (CVE-2024-11053)

    * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21497)

    * mysql: MySQL Server Options Vulnerability (CVE-2025-21520)

    * mysql: High Privilege Denial of Service Vulnerability in MySQL Server (CVE-2025-21490)

    * mysql: Information Schema unspecified vulnerability (CPU Jan 2025) (CVE-2025-21529)

    * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21531)

    * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21504)

    * mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21540)

    * mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability     (CVE-2025-21555)

    * mysql: Packaging unspecified vulnerability (CPU Jan 2025) (CVE-2025-21543)

    * mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability     (CVE-2025-21491)

    * mysql: DDL unspecified vulnerability (CPU Jan 2025) (CVE-2025-21525)

    * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21536)

    * mysql: Thread Pooling unspecified vulnerability (CPU Jan 2025) (CVE-2025-21521)

    * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21501)

    * mysql: Performance Schema unspecified vulnerability (CPU Jan 2025) (CVE-2025-21534)

    * mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21494)

    * mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21519)

    * mysql: Parser unspecified vulnerability (CPU Jan 2025) (CVE-2025-21522)

    * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21503)

    * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21518)

    * mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability     (CVE-2025-21559)

    * mysql: Privilege Misuse in MySQL Server Security Component (CVE-2025-21546)

    * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21500)

    * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21523)

    * mysql: Components Services unspecified vulnerability (CPU Jan 2025) (CVE-2025-21505)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has curl packages installed that are affected by multiple vulnerabilities:

  - CVE-2023-38546 is a cookie injection vulnerability in the curl_easy_duphandle(), a function in libcurl     that duplicates easy handles.  When duplicating an easy handle, if cookies are enabled, the duplicated     easy handle will not duplicate the cookies themselves, but would instead set the filename to none.'     Therefore, when the duplicated easy handle is subsequently used, if a source was not set for the cookies,     libcurl would attempt to load them from the file named none' on the disk.  This vulnerability is rated     low, as the various conditions required for exploitation are unlikely.  (CVE-2023-38546)

  - This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the     specific series of conditions are met. libcurl performs transfers. In its API, an application creates     easy handles that are the individual handles for single transfers. libcurl provides a function call that     duplicates en easy handle called     [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html). If a transfer has cookies     enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the     actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned     version of the handle would instead store the file name as `none` (using the four ASCII letters, no     quotes). Subsequent use of the cloned handle that does not explicitly set a source to load cookies from     would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in     the current directory of the program using libcurl. And if using the correct file format of course.
    (CVE-2023-38546)

  - CVE-2023-38545 is a heap-based buffer overflow vulnerability in the SOCKS5 proxy handshake in libcurl and     curl.  When curl is given a hostname to pass along to a SOCKS5 proxy that is greater than 255 bytes in     length, it will switch to local name resolution in order to resolve the address before passing it on to     the SOCKS5 proxy. However, due to a bug introduced in 2020, this local name resolution could fail due to a     slow SOCKS5 handshake, causing curl to pass on the hostname greater than 255 bytes in length into the     target buffer, leading to a heap overflow.  The advisory for CVE-2023-38545 gives an example exploitation     scenario of a malicious HTTPS server redirecting to a specially crafted URL. While it might seem that an     attacker would need to influence the slowness of the SOCKS5 handshake, the advisory states that server     latency is likely slow enough to trigger this bug. (CVE-2023-38545)

  - This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to     pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting     done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected     to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due     to this bug, the local variable that means let the host resolve the name could get the wrong value     during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target     buffer instead of copying just the resolved address there. The target buffer being a heap based buffer,     and the host name coming from the URL that curl has been told to operate with. (CVE-2023-38545)

  - When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later     via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would     accept in a response, allowing a malicious server to stream an endless series of headers and eventually     cause curl to run out of heap memory. (CVE-2023-38039)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1401 advisory.

    This advisory aggregates security fixes for the curl SRPM in CIQ LTS 9.6. It addresses 148 CVEs:
    CVE-2023-32001, CVE-2022-27775, CVE-2018-1000005, CVE-2022-27774, CVE-2022-32221, and 143 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
282370	Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2025-1351)	Nessus	Amazon Linux Local Security Checks	1/8/2026	1/21/2026	medium
194923	Splunk Enterprise 9.0.0 < 9.0.9, 9.1.0 < 9.1.4, 9.2.0 < 9.2.1 (SVD-2024-0303)	Nessus	CGI abuses	5/2/2024	5/12/2025	critical
213119	SUSE SLED15: curl / libcurl-devel / libcurl-devel-32bit / libcurl4 / etc (SUSE-SU-2024:4359-1)	Nessus	SuSE Local Security Checks	12/18/2024	6/26/2026	low
216621	AlmaLinux 9 : mysql (ALSA-2025:1671)	Nessus	Alma Linux Local Security Checks	2/21/2025	4/18/2025	critical
232906	RockyLinux 9 : mysql (RLSA-2025:1671)	Nessus	Rocky Linux Local Security Checks	3/19/2025	4/18/2025	critical
235985	Alibaba Cloud Linux 3 : 0038: mysql:8.0 (ALINUX3-SA-2025:0038)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/14/2025	critical
242816	NewStart CGSL MAIN 7.02 : curl Multiple Vulnerabilities (NS-SA-2025-0111)	Nessus	NewStart CGSL Local Security Checks	7/25/2025	7/26/2025	critical
353701	Rocky Linux 9.6 [CIQ] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ciqsa-2026_1401)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/13/2026	critical

Detections

Analytics

Plugins Search

medium

critical

low

critical

critical

critical

critical

critical