Nessus Network Monitor < 6.6.0 Multiple Vulnerabilities (TNS-2026-32)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(374269);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/30");

  script_cve_id(
    "CVE-2026-0989",
    "CVE-2026-0990",
    "CVE-2026-0992",
    "CVE-2026-1757",
    "CVE-2026-1965",
    "CVE-2026-3783",
    "CVE-2026-3784",
    "CVE-2026-3805",
    "CVE-2026-4873",
    "CVE-2026-5545",
    "CVE-2026-5773",
    "CVE-2026-6253",
    "CVE-2026-6276",
    "CVE-2026-6429",
    "CVE-2026-6732",
    "CVE-2026-7009",
    "CVE-2026-7168",
    "CVE-2026-8286",
    "CVE-2026-8458",
    "CVE-2026-8924",
    "CVE-2026-8925",
    "CVE-2026-8926",
    "CVE-2026-8927",
    "CVE-2026-8932",
    "CVE-2026-9079",
    "CVE-2026-9080",
    "CVE-2026-9545",
    "CVE-2026-9546",
    "CVE-2026-9547",
    "CVE-2026-11352",
    "CVE-2026-11564",
    "CVE-2026-11586",
    "CVE-2026-11979",
    "CVE-2026-14456",
    "CVE-2026-14457",
    "CVE-2026-18798",
    "CVE-2026-34180",
    "CVE-2026-34181",
    "CVE-2026-34182",
    "CVE-2026-34183",
    "CVE-2026-35189",
    "CVE-2026-35191",
    "CVE-2026-42764",
    "CVE-2026-42766",
    "CVE-2026-42767",
    "CVE-2026-42772",
    "CVE-2026-45186",
    "CVE-2026-50219",
    "CVE-2026-54872",
    "CVE-2026-54873",
    "CVE-2026-54874",
    "CVE-2026-54875",
    "CVE-2026-56131",
    "CVE-2026-56132",
    "CVE-2026-56403",
    "CVE-2026-56404",
    "CVE-2026-56405",
    "CVE-2026-56406",
    "CVE-2026-56407",
    "CVE-2026-56408",
    "CVE-2026-56409",
    "CVE-2026-56410",
    "CVE-2026-56411",
    "CVE-2026-56412",
    "CVE-2026-63072",
    "CVE-2026-63073",
    "CVE-2026-63074",
    "CVE-2026-63075",
    "CVE-2026-63076",
    "CVE-2026-66046",
    "CVE-2026-72897",
    "CVE-2026-74860",
    "CVE-2026-75803",
    "CVE-2026-75804",
    "CVE-2026-75805",
    "CVE-2026-75806",
    "CVE-2026-76641",
    "CVE-2026-76781",
    "CVE-2026-76956",
    "CVE-2026-76957",
    "CVE-2026-77214",
    "CVE-2026-77696",
    "CVE-2026-84784",
    "CVE-2026-86137",
    "CVE-2026-86138",
    "CVE-2026-86139",
    "CVE-2026-86140",
    "CVE-2026-86141",
    "CVE-2026-86142",
    "CVE-2026-86143",
    "CVE-2026-86144",
    "CVE-2026-93990",
    "CVE-2026-102633"
  );

  script_name(english:"Nessus Network Monitor < 6.6.0 Multiple Vulnerabilities (TNS-2026-32)");

  script_set_attribute(attribute:"synopsis", value:
"An instance of Tenable NNM installed on the remote system is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.6.0. It is,
therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-32 advisory.

  - In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate
    parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a
    custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial
    of service (e.g., for an attacker-controlled internet resource that is intentionally slow).
    (CVE-2026-86144)

  - libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a
    pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.
    When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network
    transfer operation that was requested by an application could wrongfully reuse an existing SMB connection
    to the same server that was using a different share than the new subsequent transfer should. This could
    in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place.
    When this happens, the same credentials are used and the server name is the same. (CVE-2026-5773)

  - A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are
    handled. The parser does not enforce a limit on inclusion depth when resolving nested <include>
    directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This
    may lead to stack exhaustion and application crashes, creating a denial-of-service risk. (CVE-2026-0989)

  - A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in
    the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references
    itself. A remote attacker could exploit this configuration-dependent issue by providing a specially
    crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a
    segmentation fault, causing a Denial of Service (DoS) by crashing affected applications. (CVE-2026-0990)

  - A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when
    processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream
    catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to
    redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application
    availability, resulting in a denial-of-service condition. (CVE-2026-0992)

  - libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc()
    function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to
    applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial
    of service. (CVE-2026-102633)

  - An issue in curl's QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial
    of service against a curl or libcurl client. Because the helper function discards zero-length UDP
    datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously
    stream empty datagrams to indefinitely stall the client. (CVE-2026-11352)

  - libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of
    them matches the setup. An easy handle that first uses default native CA trust can continue trusting the
    native platform store after the application switches that same handle to custom CA material for a later
    transfer. (CVE-2026-11564)

  - By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on
    memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by
    flooding curl with rapid, sequential PING messages. (CVE-2026-11586)

  - libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in
    --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper
    bounds checking. By supplying an overly long input line, an attacker can overflow internal buffers
    (command, arg, and argv) during input parsing. This results in memory corruption within the stack frame.
    Successful exploitation may cause a crash or potentially allow arbitrary code execution in the context of
    the xmlcatalog process. This issue has been fixed in the commit c2e233fc. NOTE: The maintainers of this
    project did not agree that this issue is a vulnerability and considered it a bug. (CVE-2026-11979)

  - Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for
    unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any
    limit. Impact summary: A remote peer that can make many Initial packets reach the server listener faster
    than the application accepts connections, can cause the memory allocated to store the per-channel state to
    grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service.
    CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The function that handles
    inbound QUIC packets uses Connection-Id from the packet header to find an existing connection (QUIC
    channel). If no existing connection is found and the packet type is INITIAL, the function treats the
    packet as a new connection. It allocates a new channel object and inserts it into a queue where it waits
    to be accepted by the local application with SSL_accept(3ossl). The memory occupied by these initial
    channel objects may grow without bounds if the application is not able to call SSL_accept() frequently
    enough to serve these inbound connection requests. The issue is present since OpenSSL 3.5 when the QUIC
    server implementation was added. The fix introduces a limit for pending connections. The default limit is
    set to 256 pending connections (waiting to be accepted by the local application). Applications may change
    the default by calling SSL_set_value_uint(3ossl). FIPS impact: no The FIPS module is not affected as the
    QUIC implementation is outside of the OpenSSL FIPS module boundary. (CVE-2026-14456)

  - Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only
    the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur
    when the remote peer solicits raw public keys and also sends the typically omitted
    signature_algorithms_cert TLS extension. Impact summary: The impact is limited to a possible Denial of
    Service as a result of an application abort, no data disclosure or remote command execution are possible.
    CWE: CWE-476: NULL Pointer Dereference Description: While a passing comment in sample code in the
    documentation suggests that key-only RPK configurations are supported, the best-practice RPK configuration
    is to always configure a corresponding certificate (possibly self-signed or signed by any convenient CA).
    When the private key is configured along with a matching certificate, the signature_algorithms_cert
    extension is handled reliably even without the fix, and peer clients or servers that don't support raw
    public keys may be able to complete a TLS connection by pinning or verifying the corresponding certificate
    or its public key. Deployments that prefer to configure just a private key with no certificate need to
    upgrade to an updated release as noted below. FIPS impact: no No FIPS modules are affected by this issue,
    as the SSL protocol implementation is outside the OpenSSL FIPS module boundary. (CVE-2026-14457)

  - A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where
    memory allocated for user input is not properly released under certain conditions. When a user submits
    input consisting only of whitespace, the program skips command execution but fails to free the allocated
    buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system
    memory and terminate the xmllint process, creating a denial-of-service condition on the local system.
    (CVE-2026-1757)

  - Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails
    for initial packet. Impact summary: Double free leads to heap corruption, which typically results in
    termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this
    double free is exploitable for remote code execution, thus it is considered highly improbable. CWE:
    CWE-415: Double Free Description: In order to validate initial packet, OpenSSL QUIC stack default packet
    handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates
    successfully with QRX object, the default packet handler proceeds to channel (connection object) creation.
    The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the
    newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once
    port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the
    error branch, where the same QRX object is freed for the second time. The failure in port_bind_channel()
    function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL
    packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then
    port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has
    invalid length. FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of
    the OpenSSL FIPS module boundary. (CVE-2026-18798)

  - libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated
    HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse
    an existing connection to avoid overhead. When reusing a connection a range of criterion must first be
    met. Due to a logical error in the code, a request that was issued by an application could wrongfully
    reuse an existing connection to the same server that was authenticated using different credentials. One
    underlying reason being that Negotiate sometimes authenticates *connections* and not *requests*, contrary
    to how HTTP is designed to work. An application that allows Negotiate authentication to a server (that
    responds wanting Negotiate) with `user1:password1` and then does another operation to the same server also
    using Negotiate but with `user2:password2` (while the previous connection is still alive) - the second
    request wrongly reused the same connection and since it then sees that the Negotiate negotiation is
    already made, it sends the request over that connection thinking it uses the user2 credentials when it is
    in fact still using the connection authenticated for user1... The set of authentication methods to use is
    set with `CURLOPT_HTTPAUTH`. Applications can disable libcurl's reuse of connections and thus mitigate
    this problem, by using one of the following libcurl options to alter how connections are or are not
    reused: `CURLOPT_FRESH_CONNECT`, `CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the
    curl_multi API). (CVE-2026-1965)

  - Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content
    exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms.
    Impact summary: The heap buffer over-read may crash the application (Denial of Service) or to load into
    the decoded ASN.1 object contents of memory beyond the end of the input buffer. More typically such ASN.1
    elements would instead be truncated. An integer truncation in OpenSSL's ASN.1 decoder causes the content
    length of an ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the worst case the
    truncated length is treated as a request to scan the binary content for a terminating zero byte, possibly
    causing OpenSSL to read either less than or beyond the end of the allocated buffer. Applications that pass
    attacker-supplied data to d2i_X509(), d2i_PKCS7(), or any other d2i_* decoding function are affected.
    OpenSSL's own command-line tools are not vulnerable, as data read through the BIO layer is checked before
    it reaches the affected code. The issue only affects 64-bit Unix and Unix-like platforms; 32-bit platforms
    and 64-bit Windows are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by
    this issue, as the affected code is outside the OpenSSL FIPS module boundary. (CVE-2026-34180)

  - Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use
    Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism allowing a certificate and
    private key forgery. Impact Summary: An attacker impersonating a user can cause a service reading PKCS#12
    files to accept forged certificates and private keys with a 1 in 256 probability. If a service accepting
    PKCS#12 files is using passwords for authenticating the received files, the attacker can create
    unencrypted PKCS#12 files that use PBMAC1 authentication that specifies an HMAC key of only one byte,
    allowing them to craft a file that will be accepted with a 1 in 256 probability. That would then cause the
    service to accept a certificate and private key controlled by the attacker. The FIPS modules are not
    affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary. (CVE-2026-34181)

  - Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input
    validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various
    potential compromises. Impact Summary: Attackers making use of these vulnerabilities may achieve key-
    equivalent functionality for a given CMS recipient and/or bypass integrity validation for a given message.
    In one use case, an attacker may send a CMS message containing AuthEnvelopedData with the cipher specified
    as a non-AEAD cipher. OpenSSL erroneously allows this selection, and attempts to decrypt and validate the
    message. An on-path attacker who captures one legitimate AES-GCM AuthEnvelopedData addressed to the victim
    can re-emit it with the recipientInfos set left byte-for-byte intact, so the victim's private key still
    unwraps the genuine CEK (the content-encryption key), but with the inner OID rewritten to AES-256-OFB
    (Output Feedback Mode, an unauthenticated keystream mode) and with an attacker-chosen IV and ciphertext.
    The victim initializes AES-256-OFB under the real CEK, never consults the MAC field, and CMS_decrypt()
    returns success. If the application under attack responds to the attacker with any indicator showing
    success or failure of the decryption effort, it is possible for the attacker to use this as an oracle to
    obtain key equivalent functionality for the CEK used for the chosen recipient of the message. In another
    use case, an attacker can reduce the tag length of the chosen AEAD cipher for a given AuthEnvelopedData
    container to be a single byte long, allowing an attacker to brute force CMS decryption, producing an
    integrity bypass for applications that trust CMS_decrypt() to reject modified content. The FIPS modules
    are not affected by this issue. (CVE-2026-34182)

  - Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with
    packets containing PATH_CHALLENGE frames. Impact summary: A malicious remote peer can cause an unbounded
    memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or
    server and a Denial of Service. A remote peer may exhaust heap memory by flooding the local QUIC stack
    with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE
    it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception
    of the PATH_RESPONSE frame which will not be done by a malicious peer. The FIPS modules in 4.0, 3.6, 3.5,
    3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.
    (CVE-2026-34183)

  - Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes
    disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted
    certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service
    in clients or in servers that solicit client certificates. CWE: CWE-770: Allocation of Resources Without
    Limits or Throttling Description: A certificate or a set of certificates that fits under the limit for
    size of certificates accepted from the peer (~100 KiB) can result in allocation of several hundred MiB of
    resident memory on the receiving side during a normal TLS handshake. This may be enough to crash the
    client or server, if multiple concurrent connections lead to similarly large memory allocations. The fix
    postpones processing of the CRL distribution points extensions in certificates to the time when the
    processed value is required for CRL processing. This avoids keeping large memory allocations for a long
    time when such certificates are received. FIPS impact: no The affected code is outside the FIPS module
    boundary. (CVE-2026-35189)

  - Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced
    to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of
    the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data received. Impact
    summary: A remote attacker able to spoof packets to a server using the OpenSSL QUIC implementation might
    use the server for an amplification of a DDoS attack. CWE: CWE-440: Expected Behavior Violation
    Description: OpenSSL's QUIC stack, when operating as a server, enforces client address validation (RFC
    9000, Section 8), to confirm the peer address is not used for a traffic amplification attack. If this
    feature is disabled on the server, the QUIC stack limits the amount of server data that can be sent to 3
    times the amount of data received from the peer address, until such time as the TLS handshake is
    completed. The OpenSSL QUIC server, when operating in non-validation mode, adds the length of the whole
    datagram received to the unvalidated credit limit when processing each QUIC packet in the datagram. A
    remote peer may, after establishing a connection with an initial client hello frame, send a subsequent
    datagram containing multiple QUIC packets, leading the server to account the entire datagram length for
    each packet in the datagram, resulting in the server believing that the peer has sent more data than it
    actually has, thereby violating the 3x amplification limit mandated by the RFC. FIPS impact: no As the
    QUIC stack lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.
    (CVE-2026-35191)

  - When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a
    second URL, curl could leak that token to the second hostname under some circumstances. If the hostname
    that the first request is redirected to has information in the used .netrc file, with either of the
    `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the
    second one. (CVE-2026-3783)

  - curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new
    request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate
    connection. (CVE-2026-3784)

  - When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing
    into already freed memory. (CVE-2026-3805)

  - Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer
    dereference in the OpenSSL QUIC server with address validation disabled. Impact summary: NULL pointer
    dereference typically causes abnormal termination of the affected QUIC server process and a Denial of
    Service. If the address validation is disabled in the OpenSSL QUIC server implementation, an attacker can
    crash the server by sending an initial packet with an invalid or expired token. By default, the client
    address validation is enabled in the OpenSSL QUIC server implementation, which makes the default
    configuration not vulnerable to this issue. However if the SSL_LISTENER_FLAG_NO_VALIDATE is used with the
    SSL_new_listener() call, the address validation is disabled making the vulnerable code reachable. The FIPS
    modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the
    OpenSSL FIPS module boundary. (CVE-2026-42764)

  - Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference
    during CMS decryption. Impact summary: This NULL pointer dereference leads to an application crash and a
    Denial of Service. The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as OPTIONAL in
    the ASN.1 specification and may therefore be absent in specially crafted inputs. During the password-based
    CMS decryption the OpenSSL CMS implementation dereferences this field without first checking whether it
    was present. An attacker who supplies such a CMS message to an application performing password-based CMS
    decryption can trigger an application crash, leading to a Denial of Service. Applications that process
    password-encrypted CMS messages may be affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not
    affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary. (CVE-2026-42766)

  - Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL
    pointer dereference in a CMP client application. Impact summary: A NULL pointer dereference causes a crash
    of the application and a Denial of Service. An attacker controlling a CMP server (or acting as a man-in-
    the-middle) could craft a CMP response containing a CRMF (Certificate Request Message Format)
    CertRepMessage with an EncryptedValue structure where the symmAlg field has an algorithm OID but no
    parameters field. When the OpenSSL CMP client processes this response, the NULL dereference occurs,
    causing a crash of the CMP client. Applications that process untrusted CMP/CRMF messages may be affected.
    The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is
    outside the OpenSSL FIPS module boundary. (CVE-2026-42767)

  - Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are
    arriving out of order. The worst case has a quadratic complexity proportional to the number of stream
    frames kept in the buffer for the received stream data. Impact summary: A remote QUIC peer that completes
    the handshake can create a connection-scoped CPU pressure and potentially a Denial of Service using
    compliant STREAM frames inside the advertised receive window, with low attacker bandwidth. CWE: CWE-407:
    Inefficient Algorithmic Complexity Description: OpenSSL manages received QUIC stream fragments using a
    doubly-linked list. While it optimizes for append operations (at the end of the list), it falls back to a
    head-to-tail linear search for any fragment that does not immediately follow the current `tail`. By
    manipulating the sequence of offsets, an attacker can force the server to perform O(n^2) operations,
    consuming excessive CPU time for the QUIC process. FIPS impact: no The FIPS module is not affected as the
    QUIC implementation is outside of the OpenSSL FIPS module boundary. (CVE-2026-42772)

  - In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial
    of service via moderately sized crafted XML input. (CVE-2026-45186)

  - A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted
    connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or
    POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data
    unencrypted. (CVE-2026-4873)

  - libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse,
    XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation.
    Thus, a use-after-free can occur, (CVE-2026-50219)

  - Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature
    operations with curves that do not have a dedicated implementation leaks information about the secret
    nonce through timing. Impact summary: An attacker able to measure signing times may learn information
    about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number
    Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy
    Description: The generic elliptic-curve scalar multiplication used for curves that do not have a dedicated
    constant-time implementation pads the secret scalar with non-constant-time BIGNUM operations, so the time
    taken depends on the value of the secret scalar derived from the ECDSA and SM2 nonce. The leak is very
    small; observing it requires a large number of measurements. The effect is largest for curves whose group
    order lies on a machine-word boundary, such as brainpoolP384r1. Applications using ECDSA signing over the
    Brainpool and other generic prime curves, and SM2 signing on platforms that use the generic
    implementation, are vulnerable to this issue. The NIST curves P-256, P-384 and P-521 use dedicated
    constant-time implementations and are not affected. FIPS Impact: no The FIPS modules are not affected: the
    approved NIST curves used in the FIPS provider have dedicated constant-time implementations and do not use
    the affected code path. (CVE-2026-54872)

  - Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary.
    Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making
    the local QUIC stack to keep the memory for packet buffers allocated. The time for which the memory
    remains allocated is entirely under the control of the potentially malicious remote peer. CWE: CWE-770:
    Allocation of Resources Without Limits or Throttling Description: To save copy operation from the packet
    buffer to the stream reassemble buffer the QUIC stack leaves the stream data on the packet buffer waiting
    to be copied to a buffer provided by the local receiving application. The QUIC stack releases a reference
    to the packet buffer only after the data are copied to the application buffer. This design is more
    efficient for legitimate data transfers but enables an attacker to allocate a lot more memory than
    actually required by the data kept in the receiving stream buffer. To mitigate the vulnerability, the QUIC
    stack now calculates and monitors memory overhead for every stream. The memory overhead for a single
    stream frame is calculated as a difference between the size of the whole packet that carries the stream
    frame and the size of the stream frame itself. The memory overhead for a single stream frame is added to
    the total (cumulative) memory overhead QUIC stack keeps for each stream. Once the cumulative memory
    overhead exceeds 64kB, the QUIC stack moves the stream frame data from the packet buffer to the stream
    buffer, starting with the next packet received. FIPS impact: no The FIPS module is not affected as the
    QUIC implementation is outside of the OpenSSL FIPS module boundary. (CVE-2026-54873)

  - Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL
    to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount
    of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory,
    which may lead to a Denial of Service. CWE: CWE-405: Asymmetric Resource Consumption (Amplification)
    Description: While a DTLS handshake is in progress, a peer may legitimately have already moved on to the
    next epoch (for example, having sent its ChangeCipherSpec and Finished messages) before the local endpoint
    has processed the same transition, typically because of reordering on the underlying UDP transport.
    OpenSSL buffers such early records so that they can be processed once the local endpoint catches up.
    Buffering a record currently retains the entire read buffer it arrived in, which is sized to hold the
    largest possible DTLS record (around 16 kilobytes), rather than just the bytes that make up the record
    itself. Up to 100 such records may be buffered per connection. As a result, a peer that sends a stream of
    small forged records claiming to belong to the next epoch can cause an OpenSSL DTLS endpoint to retain
    around 1.7 megabytes of memory, despite sending only a small fraction of that amount of data over the
    network. An attacker therefore gains a memory amplification factor of around 1200, and can multiply the
    effect across as many associations as it is able to open, making this a remote memory exhaustion Denial of
    Service risk for DTLS servers. Since the memory retained per connection remains bounded, and any limit an
    application already places on the number of concurrent associations also bounds the total exposure, this
    issue has been assessed as Low severity. FIPS impact: no No FIPS modules are affected by this issue as the
    affected code is outside the OpenSSL FIPS module boundary. OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and
    1.0.2 are vulnerable to this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.2. OpenSSL 3.6 users
    should upgrade to OpenSSL 3.6.4. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.8. OpenSSL 3.4 users
    should upgrade to OpenSSL 3.4.7. OpenSSL 3.0 users should upgrade to OpenSSL 3.0.22. Premium support
    customers only: OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi OpenSSL 1.0.2 users should upgrade
    to OpenSSL 1.0.2zr This issue was reported on 18 May 2026 by Amazon Web Services. The fix has been
    developed by Matt Caswell. -- cut (non-publishing metadata for internal use) -- Reported by: Amazon Web
    Services Fixed by: Matt Caswell (CVE-2026-54874)

  - Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2
    private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time
    taken by, or to observe the cache-line access pattern of SM2 signing or decryption on an affected platform
    can learn information about the secret scalar. CWE: CWE-208: Observable Timing Discrepancy Description: On
    ARM64 and RISC-V processors, the SM2 curve uses an optimized scalar multiplication implementation whose
    conditional branches and table look ups are chosen according to the bits of the secret scalar. The
    execution time and the cache-access pattern therefore depend on the long-term private key (during SM2
    decryption) or the per-signature nonce (during SM2 signature generation), forming a timing and cache side-
    channel. FIPS Impact: no SM2 is not a FIPS algorithm and the optimized SM2 implementation is not part of
    the FIPS module. OpenSSL 4.0, 3.6, 3.5 and 3.4 are vulnerable to this issue on AArch64 and RISC-V. OpenSSL
    3.0, 1.1.1 and 1.0.2 are not affected by this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.3.
    OpenSSL 3.6 users should upgrade to OpenSSL 3.6.5. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.9.
    OpenSSL 3.4 users should upgrade to OpenSSL 3.4.8. This issue was reported on 2 May 2026 by Abhinav
    Agarwal. It was independently reported on 6 June 2026 by Feng Xue. The fix was developed by Igor Ustinov.
    -- cut (non-publishing metadata for internal use) -- Reported by: Abhinav Agarwal, Feng Xue Fixed by: Igor
    Ustinov (CVE-2026-54875)

  - libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S)
    request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of
    recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When
    reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that
    was issued by an application could wrongfully reuse an existing connection to the same server that was
    authenticated using different credentials. An application that first uses Negotiate authentication to a
    server with `user1:password1` and then does another operation to the same server asking for any
    authentication method but for `user2:password2` (while the previous connection is still alive) - the
    second request gets confused and wrongly reuses the same connection and sends the new request over that
    connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the
    connection authenticated for user1... (CVE-2026-5545)

  - libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers
    in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219
    situation). (CVE-2026-56131)

  - In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold
    backing array reallocation is mishandled when there is data-structure sharing across parsers.
    (CVE-2026-56132)

  - libexpat before 2.8.2 has an integer overflow in storeAtts. (CVE-2026-56403)

  - libexpat before 2.8.2 has an integer overflow in addBinding. (CVE-2026-56404)

  - libexpat before 2.8.2 has an integer overflow in getAttributeId. (CVE-2026-56405)

  - libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was
    present in XML_Parse. (CVE-2026-56406)

  - libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity
    textLen. (CVE-2026-56407)

  - libexpat before 2.8.2 has an integer overflow in copyString. (CVE-2026-56408)

  - xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.
    (CVE-2026-56409)

  - xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId. (CVE-2026-56410)

  - xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.
    (CVE-2026-56411)

  - libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call
    depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-
    free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219. (CVE-2026-56412)

  - curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the
    following conditions are true: 1. curl is setup to use specific different proxies for different URL
    schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the
    first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say
    `https://`), accessed using a second, different, proxy (CVE-2026-6253)

  - Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is
    subsequently done using the same *easy handle* but without the custom `Host:` header set, the second
    request would use stale information and pass on cookies meant for the first host in the second request.
    Leak them. (CVE-2026-6276)

  - Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped
    key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports,
    causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a crafted CMS message
    can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with
    CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service. CWE: CWE-787: Out-of-
    bounds Write Description: The key-wrap OID is potentially attacker-controlled on the wire. CMS unwrapping
    allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers. An attacker can take a legitimate message and
    change a single OID byte to select the padded variant while leaving the message otherwise valid. Since the
    unwrap key is derived from the recipient's private operation (ECDH key agreement or ML-KEM decapsulation),
    the RFC 5649 integrity check cannot pass, and the decryption fails with integrity failure. The write is a
    fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the allocation, requires no special
    configuration, and is reachable from the public CMS_decrypt() function. The consequence is a heap
    corruption leading to a Denial of Service. The fix in the CMS code sizes the unwrap output buffer for the
    worst case so a failed unwrap cannot write past the allocation. FIPS impact: no As the CMS code lives
    outside the FIPS module boundary, no FIPS modules are affected by this CVE. (CVE-2026-63072)

  - Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name
    directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP
    endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate whose
    subject becomes the default expected sender. CWE: CWE-134 (Use of Externally-Controlled Format String)
    Description: When validating a received CMP message, ossl_cmp_msg_check_update() converts the peer-
    supplied sender distinguished name with X509_NAME_oneline() and passes it directly as the format argument
    to ERR_raise_data(). Percent characters survive the conversion, so a sender DN such as CN=%s%n reaches
    BIO_vsnprintf() as an attacker-controlled format string with no matching variadic arguments. This path is
    only reached when the caller configures an expected sender or pins a server certificate, which is the
    normal configuration for a CMP client validating server responses. Since the attacker controls the format
    string but none of the variadic arguments, such specifiers as %s and %n dereference or write through
    unrelated stack contents and crash the client. The reliable consequence is a denial of service, when the
    response comes from a malicious or intercepted CMP endpoint. There is no controlled memory write,
    arbitrary-address read, or reliable path to remote code execution. FIPS impact: no No FIPS modules are
    affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.
    (CVE-2026-63073)

  - Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates
    (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a
    server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious
    client may flood a CMP server with requests driving this growth. Impact summary: Users utilizing a CMP
    server that reuses a single OSSL_CMP_CTX for the lifetime of a server process may observe unbounded memory
    growth in the event a malicious client repeatedly sends requests containing unique extra certificates,
    which may lead to OOM conditions. CWE: CWE-770: Allocation of Resources Without Limits or Throttling
    Description: If a remote user sends CMP messages to a server with a list of extraCerts and the message is
    rejected, the extraCerts from the message remains in the server contexts untrusted certificate stack. This
    exposes servers with long lived ctx objects to Denial of Service attacks in which an attacker sends
    messages intending to be rejected with a large list of additional certificates repeatedly, forcing the
    server to store them indefinitely. The issue was fixed by removing the added extra certs if the message is
    rejected, using the same method as when the context is configured to not do caching at all. FIPS impact:
    no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.
    (CVE-2026-63074)

  - Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets
    while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the
    lifetime of the connection. Impact summary: A remote peer that can complete a QUIC handshake can cause
    connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially
    with sustained traffic or many concurrent QUIC connections. CWE: CWE-770: Allocation of Resources Without
    Limits or Throttling Description: When the OpenSSL QUIC stack sends an ACK-only packet, there is no
    requirement by the QUIC protocol that the peer will acknowledge that ACK-only packet (i.e. it is itself
    not ack-eliciting). However, the OpenSSL implementation stores the metadata about the ACK frames
    regardless. In and of itself that's ok, but if a malicious peer establishes a connection, and then drives
    the connection such that ACK-only packets are forced from the OpenSSL implementation peer (i.e., by
    sending numerous PING frames), and then withholding any subsequent acks for ack-eliciting data, like
    legitimate data, said malicious peer can force inappropriate memory growth on the OpenSSL peer,
    potentially leading to a Denial of Service. The fix is to ensure that we account for the transmission of
    the ACK-only packet in the packet histories high and low watermark without actually storing the ACK-only
    packet metadata itself. FIPS impact: no The OpenSSL FIPS module is not affected as the QUIC code is
    outside the FIPS module boundary. (CVE-2026-63075)

  - Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg
    parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can
    contain a parameter of a different type, which is then dereferenced as an invalid pointer. Impact summary:
    A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-
    protected messages, or a CMP client talking to a malicious or intercepted CMP server, resulting in a
    Denial of Service. CWE: CWE-476: NULL Pointer Dereference Description: When verifying the password-based
    MAC protection of a CMP message, OpenSSL library reads the protectionAlg algorithm parameter with
    X509_ALGOR_get0(), which returns both the parameter type and its value pointer. The value is then cast to
    an ASN1_STRING and treated as the expected PBMParameter after only checking that pointer is not NULL. The
    parameter type returned by X509_ALGOR_get0() was never consulted. This happens during protection
    verification, before any MAC is computed, so no knowledge of the PBM shared secret is required; the only
    precondition is that PBM verification is reachable. On the server side this is reached from
    OSSL_CMP_SRV_process_request() for any application that stands up a CMP server accepting PBM-protected
    messages, and on the client side from CMP response validation against a malicious or on-path (MITM)
    server. The reliable consequence is a denial of service; there is no memory disclosure, no controlled
    memory write, and no path to code execution. CMP is a specialized feature that an application must
    explicitly enable. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules
    are affected by this CVE. (CVE-2026-63076)

  - When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak
    the password used for the first host to the followed-to host under certain circumstances. (CVE-2026-6429)

  - Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity
    in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized
    values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote
    unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application
    parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring
    authentication, external entity resolution, or non-default parser options. (CVE-2026-66046)

  - A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML
    Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could
    exploit this by providing a malicious document, leading to a type confusion error that causes the
    application to crash. This results in a denial of service (DoS), making the affected system or application
    unavailable. (CVE-2026-6732)

  - When curl is told to use the Certificate Status Request TLS extension, often referred to as *OCSP
    stapling*, to verify that the server certificate is valid, it fails to detect OCSP problems and instead
    wrongly consider the response as fine. (CVE-2026-7009)

  - Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest**
    authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing
    the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`,
    to `proxyB`. (CVE-2026-7168)

  - Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX
    part way through a handshake may access memory beyond the end of an internal array if the replacement
    context knows about more provider signature algorithms than the context the connection was created from.
    Applications which never call SSL_set_SSL_CTX() are not affected. Impact summary: A remote peer may be
    able to cause a small out-of-bounds read, and in some circumstances a fixed-value out-of-bounds write, on
    the server heap. This may lead to a Denial of Service. CWE: CWE-787: Out-of-bounds Write Description: A
    TLS connection records how many certificate slots it has when it is created, taken from the SSL_CTX that
    created it: the built-in certificate types plus one slot for each provider TLS-SIGALG entry that context
    was aware of. That count sizes an internal array of per-slot certificate validity flags. An application
    may replace a connection's SSL_CTX part way through the handshake by calling SSL_set_SSL_CTX(), most
    commonly from a servername callback in order to serve a different virtual host. Doing so did not refresh
    the recorded count. A provider signature algorithm's slot index is its position in the list of whichever
    context resolves it, so if the replacement context is aware of more of them than the original, an
    algorithm offered by the peer can resolve to an index beyond the end of the array. Processing the peer's
    signature algorithms then reads one four byte word past the end for each such algorithm and, where the
    word read is zero, writes a fixed value over it. A peer offering many of them can corrupt heap metadata
    and abort the process. Only provider signature algorithms which occupy one of the excess slots, and which
    the server also has configured, have this effect. Codepoints the replacement context does not recognise
    are discarded without being resolved to a slot, and provider signature algorithms are usable only from TLS
    1.3. The two contexts must therefore be aware of different numbers of provider signature algorithms, which
    requires separate library contexts, a provider loaded between the two being created, or providers which
    differ in what they advertise - in 4.0, for example, the default provider advertises SM2 where the FIPS
    provider does not. A deployment meeting the condition is also unable to negotiate the affected algorithms
    with legitimate clients, since the same stale count hides the corresponding certificates, so the
    misconfiguration is likely to be noticed. For that reason, and because the configuration is not the
    default, this issue has been assessed as Low severity. FIPS impact: no No FIPS modules are affected by
    this issue as the affected code is outside the OpenSSL FIPS module boundary. (CVE-2026-72897)

  - A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this
    vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD)
    with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback
    handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a
    reproducible crash in Python applications using the libxml2 SAX bindings. (CVE-2026-74860)

  - Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success
    without verifying the supplied authentication tag when the operation is finalized by calling the
    EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and
    expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of
    Integrity Check Value) Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot
    encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for
    AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was
    passed to the function. The callers of this function might believe that a successful return indicates a
    valid AEAD tag for these ciphers, even when that has not truly been validated in this case. FIPS impact:
    no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected algorithms
    are not FIPS approved and thus not implemented in the FIPS module. (CVE-2026-75803)

  - Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers
    may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious
    remote peer may exploit the lack of connection flow control for streams to make the QUIC stack receive
    ~100MB of memory instead of 768 KiB (default flow control window size). CWE: CWE-770: Allocation of
    Resources Without Limits or Throttling Description: The local QUIC stack advertises two flow control
    limits to its remote peer: stream flow control limit and connection flow control limit. The remote peer
    must follow both limits when transmitting stream data. Whenever the local QUIC stack receives a stream
    frame, it validates that the size of the received stream frame stays within flow control limits. If either
    limit is exceeded (stream level or connection level), then the QUIC stack must close the connection with a
    flow control error. The vulnerable OpenSSL QUIC stack enforces the stream-level but not the connection-
    level limit. To exploit the issue, three conditions must be met: - the remote peer opens several streams -
    each stream must stay within the stream-level flow control limit - there must be no zero-offset byte sent
    on any of the streams (to prevent the vulnerable QUIC stack from consuming data). By meeting the
    conditions above, the remote peer may make the local stack allocate 2 x MAX_STREAMS x (stream flow control
    limit) bytes of memory. MAX_STREAMS defaults to 100, and the limit applies to both bidirectional and
    unidirectional streams, making it 200 in total. The default flow control window for a stream is 512kB. The
    remote peer may force the vulnerable QUIC stack to allocate 100MB of heap per connection. FIPS impact: no
    The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.
    (CVE-2026-75804)

  - Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may
    dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact
    summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial of Service for
    the affected client application. CWE: CWE-476: NULL-pointer dereference Description: A CMP client revoking
    a certificate has to tell the server which certificate to revoke, and may do so by supplying a PKCS#10 CSR
    instead of the certificate itself or its issuer name and serial number. This is 'openssl cmp -cmd rr -csr
    <file>' on the command line, or OSSL_CMP_exec_RR_ses() with the certificate supplied via
    OSSL_CMP_CTX_set1_p10CSR() through the API. A CSR does not contain the issuer name and serial number of
    the certificate, so the client does not send them. A server may optionally name the certificate it revoked
    in its response, and the client then compares that name against what it sent. Having sent neither an
    issuer name nor a serial number, it has nothing to compare against, and a server returning a specially
    crafted name causes the client to read from a NULL pointer and crash. The revocation response is checked
    for valid message protection before the affected code is reached, so an attacker must be a malicious or
    compromised CMP server, or a man-in-the-middle in possession of the secret used for message protection.
    Clients that identify the certificate to be revoked by a certificate or by issuer and serial number rather
    than by a PKCS#10 CSR are not affected. FIPS impact: no No FIPS modules are affected by this issue, as the
    CMP protocol implementation is outside the OpenSSL FIPS module boundary. (CVE-2026-75805)

  - Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a
    single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and
    authentication tag overhead. Impact summary: An attacker who can send a datagram that is routed to an
    existing DTLS 1.2 association can tear that association down without knowing any key material. This is a
    Denial of Service limited to the targeted association. There is no memory safety or confidentiality
    impact. CWE: CWE-1284: Improper Validation of Specified Quantity in Input Description: In TLS 1.2 and DTLS
    1.2 every record protected by an AEAD cipher suite carries an explicit IV followed by the ciphertext and
    an authentication tag. When decrypting such a record the record layer passed the record length to the
    cipher implementation before checking that the record was long enough to contain the explicit IV and the
    tag. For a record shorter than that overhead the cipher implementation rejected the impossible length, and
    the record layer treated this as an internal failure and raised a fatal internal_error alert instead of
    treating the record as one that failed authentication. In TLS 1.2 the same record causes a fatal
    internal_error alert instead of the expected bad_record_mac alert. Since any undecryptable record already
    terminates a TLS connection, this is a protocol conformance issue rather than a security issue in TLS. The
    fix validates the record length against the explicit IV and tag length before any AEAD processing, so that
    TLS reports bad_record_mac and DTLS silently discards the record. FIPS impact: no The affected code is
    outside the FIPS module boundary. (CVE-2026-75806)

  - Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory
    corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A
    struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past
    allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a
    wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for
    CVE-2026-66046. (CVE-2026-76641)

  - A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can
    trigger a NULL pointer dereference during XML catalog parsing. This occurs when a `nextCatalog` element
    lacks its mandatory `catalog` attribute, leading to the application crashing and causing a Denial of
    Service (DoS). (CVE-2026-76781)

  - In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to
    insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of
    service via crafted XML content. (CVE-2026-76956)

  - libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-
    free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
    (CVE-2026-76957)

  - libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c.
    XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied
    length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move
    m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this
    path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER.
    A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly
    through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap
    memory to the calling application, recovering heap pointers, libc function pointers, and code pointers
    sufficient to defeat ASLR and build further exploitation primitives. (CVE-2026-77214)

  - Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a
    timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information
    about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number
    Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy
    Description: SM2 signature generation computes the signature value using variable-time BIGNUM operations
    on the secret nonce and the private key, so the time taken to produce an SM2 signature depends on these
    secret values, forming a timing side-channel. Applications performing SM2 signature generation are
    affected on all platforms. FIPS Impact: no SM2 is not a FIPS algorithm. (CVE-2026-77696)

  - A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an
    existing live connection even though the TLS configuration mismatches so it should not. (CVE-2026-8286)

  - libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated
    ones, even when they are set to use different services. libcurl features a pool of recent connections so
    that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a
    range of criteria must be met. Due to a logical error in the code, a request that was issued by an
    application could wrongfully reuse an existing connection to the same server that was authenticated using
    different services. (CVE-2026-8458)

  - Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by
    avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local
    QUIC stack sends a RETIRE_CONN_ID frame for every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID
    frame is dispatched via the Control Frame Queue (CFQ). If the remote peer also withholds ACKs, then it can
    force the local stack to allocate ~400MB (depending on ACK delay). CWE: CWE-770: Allocation of Resources
    Without Limits or Throttling Description: RFC 9000 sections 5.1.1 and 5.1.2 [1] describe the mechanism by
    which a remote peer can notify the local QUIC stack to change the destination connection ID (a.k.a. CID)
    the local stack uses to identify the connection at the remote peer. Each CID is associated with a sequence
    number. The sequence number is transmitted in NEW_CONNECTION_ID and RETIRE_CONNECTION_ID frames to
    identify the CID which is being either associated with a connection or retired. The remote peer sends a
    NEW_CONNECTION_ID frame to let the local stack know a new CID is being associated with an existing
    connection. The NEW_CONNECTION_ID frame carries the new CID, its sequence number, and the retire-prior-to
    number. The retire-prior-to identifies existing CIDs that are to be retired. The local QUIC stack must
    send a RETIRE_CONNECTION_ID for every destination CID whose sequence number is less than retire-prior-to.
    The CID becomes retired after the local stack receives an ACK for its RETIRE_CONNECTION_ID frame. Although
    the OpenSSL QUIC stack supports at most one destination CID for every connection, it can be tricked into
    processing more than one RETIRE_CONNECTION_ID frame per connection. The OpenSSL QUIC stack currently
    retires the destination CID as soon as it receives the NEW_CONNECTION_ID, while in fact the destination
    CID must be retired after an ACK for the RETIRE_CONNECTION_ID frame is received. Correcting the flawed
    logic also fixes the backlog growth. [1] https://datatracker.ietf.org/doc/html/rfc9000#name-issuing-
    connection-ids FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of
    the OpenSSL FIPS module boundary. (CVE-2026-84784)

  - In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in
    the NXT macro in xmlregexp. (CVE-2026-86137)

  - In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based
    buffer overflow. (CVE-2026-86138)

  - In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow. (CVE-2026-86139)

  - In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
    (CVE-2026-86140)

  - xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup
    failure, i.e., it does not calculate a string length after NULL checking. (CVE-2026-86141)

  - In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of
    xmlXPtrEval xpointer length saturation. (CVE-2026-86142)

  - In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes
    negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling
    writecallback. This has security relevance for many types of uses of that length value within a callback.
    (CVE-2026-86143)

  - A flaw in curl's cookie parsing logic allows a malicious HTTP server to set super cookies that bypass
    the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl
    subsequently scopes and transmits to unrelated third-party domains. (CVE-2026-8924)

  - The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice*
    without clearing the pointer in between, making it `free()` the same pointer twice. (CVE-2026-8925)

  - When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a
    username (without a password), like `https://[email protected]/`, curl could wrongly get and use the
    password for *another* user set in the `.netrc` file for that host if such a one exists and there is no
    match for the specified user. (CVE-2026-8926)

  - When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration,
    libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial
    transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB`
    erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`. (CVE-2026-8927)

  - libcurl would reuse a previously created connection even when some mTLS config related option had been
    changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool
    for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to
    client certificates were left out from the configuration match checks, making them match too easily. In
    particular options related to the private key. (CVE-2026-8932)

  - libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so,
    leaving the old credentials around to get used for subsequent transfers that should not know nor use them.
    (CVE-2026-9079)

  - Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-
    after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer
    immediately after that pointer's memory has been freed. (CVE-2026-9080)

  - Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate,
    allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing
    lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to
    applications built with XML_UNICODE and to silently replace input characters in other builds.
    (CVE-2026-93990)

  - In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a
    second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid
    certificate. When libcurl returns to the hostname the second time with a cached SSL session
    (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is
    set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection
    *before* enforcing the certificate verification failure. Potentially leaking sensitive information.
    (CVE-2026-9545)

  - A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared.
    While the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option
    failed to clear the internal state. As a result, the previous referrer string was erroneously reused and
    sent in subsequent requests, potentially leaking sensitive information to unintended servers.
    (CVE-2026-9546)

  - When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the
    `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs
    when a server presents a host key type that does not match the specific key type already recorded for that
    host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to
    properly enforce the restriction, allowing the connection to succeed without warning and risking a
    potential man-in-the-middle attack. (CVE-2026-9547)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.tenable.com/downloads/tenable-network-monitor");
  # https://docs.tenable.com/release-notes/Content/network-monitor/2026.htm
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a3b0825c");
  script_set_attribute(attribute:"see_also", value:"https://www.tenable.com/security/TNS-2026-32");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Nessus Network Monitor 6.6.0 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-63073");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-63073");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-93990");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"Critical");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/11/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/30");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:tenable:nnm");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nnm_installed_win.nbin", "nnm_installed_nix.nbin");
  script_require_keys("installed_sw/Tenable NNM", "Host/nnm_installed");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Tenable NNM', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version' : '6.6.0'}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);