According to the versions of the libuv package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function     in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to     256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like     `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft     payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due     to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and     subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a     terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar     to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache     these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username.
    This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known     workarounds for this vulnerability.(CVE-2024-24806)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libuv security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libuv package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function     in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to     256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like     `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft     payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due     to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and     subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a     terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar     to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache     these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username.
    This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known     workarounds for this vulnerability.(CVE-2024-24806)

Tenable has extracted the preceding description block directly from the EulerOS libuv security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4756 advisory.

    libuv is a multi-platform support library with a focus on asynchronous I/O.

    Security Fix(es):

    * libuv: Improper Domain Lookup that potentially leads to SSRF attacks (CVE-2024-24806)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-8597:02 advisory.

    * libuv: Improper Domain Lookup that potentially leads to SSRF attacks (CVE-2024-24806)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0314 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-24806:
    libuv is a multi-platform support library with a focus on asynchronous I/O. The uv_getaddrinfo function in     src/unix/getaddrinfo.c (and its windows counterpart src/win/getaddrinfo.c), truncates hostnames to 256     characters before calling getaddrinfo. This behavior can be exploited to create addresses like     0x00007f000001, which are considered valid by getaddrinfo and could allow an attacker to craft payloads     that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how     the hostname_ascii variable (with a length of 256 bytes) is handled in uv_getaddrinfo and subsequently in     uv__idna_toascii. When the hostname exceeds 256 characters, it gets truncated without a terminating null     byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that     allows users to have username.example.com pages. Internal services that crawl or cache these user pages     can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been     addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this     vulnerability.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1762363908 advisory.

  - libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function     in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to     256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like     `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft     payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due     to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and     subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a     terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar     to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache     these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username.
    This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known     workarounds for this vulnerability. (CVE-2024-24806)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2024_4756 advisory.

    * libuv: Improper Domain Lookup that potentially leads to SSRF attacks (CVE-2024-24806)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
198087	EulerOS Virtualization 2.11.1 : libuv (EulerOS-SA-2024-1717)	Nessus	Huawei Local Security Checks	5/29/2024	5/29/2024	high
198101	EulerOS Virtualization 2.11.0 : libuv (EulerOS-SA-2024-1728)	Nessus	Huawei Local Security Checks	5/29/2024	5/29/2024	high
198203	EulerOS 2.0 SP12 : libuv (EulerOS-SA-2024-1743)	Nessus	Huawei Local Security Checks	5/30/2024	5/30/2024	high
198310	EulerOS 2.0 SP11 : libuv (EulerOS-SA-2024-1790)	Nessus	Huawei Local Security Checks	6/3/2024	6/3/2024	high
203672	RHEL 9 : libuv (RHSA-2024:4756)	Nessus	Red Hat Local Security Checks	7/23/2024	11/7/2024	high
292607	MiracleLinux 9 : libuv-1.42.0-2.el9_4 (AXSA:2024-8597:02)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	high
238981	TencentOS Server 3: libuv (TSSA-2024:0314)	Nessus	Tencent Local Security Checks	6/16/2025	11/20/2025	high
361293	AlmaLinux 9.2 [TuxCare] Security Update: libuv / libuv-devel / libuv-static (ALMALINUX9.2:CLSA-2025:1762363908)	Nessus	Alma Linux Local Security Checks	10/1/2026	10/1/2026	high
355812	Rocky Linux 9 [CIQ] Security Update: libuv / libuv-debuginfo / libuv-debugsource / libuv-devel (crlsa-2024_4756)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/1/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high