Linux Distros Unpatched Vulnerability : CVE-2026-67211

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(345641);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/14");

  script_cve_id("CVE-2026-67211");

  script_name(english:"Linux Distros Unpatched Vulnerability : CVE-2026-67211");

  script_set_attribute(attribute:"synopsis", value:
"The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be
patched.");
  script_set_attribute(attribute:"description", value:
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied
patch available.

  - OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellModelSerializer Versions
    Affected: - 3.0.0-M4 - 3.0.0-M5 (The opennlp-spellcheck extension was introduced in 3.0.0-M4. Releases 1.x
    and 2.x do not contain the affected code.) Description: The SymSpellModelSerializer.create() method reads
    two 32-bit signed integer count fields (unigramCount and bigramCount) from a binary SymSpell model stream
    and passes each value directly to LinkedHashMap.newLinkedHashMap() after validating only that it is non-
    negative. No upper bound is applied, so the count is fully attacker-controlled when the model file
    originates from an untrusted source. A crafted .bin model file in which either count field is set to
    Integer.MAX_VALUE (or any value large enough to exhaust the available heap) causes the map to be pre-sized
    to a capacity of 2^30 entries. The oversized backing array is allocated on the first put() into that map,
    requesting 48 GB depending on whether compressed oops are in effect, and the load fails with an
    OutOfMemoryError. Because the count fields sit immediately after a fixed-size header (magic, format
    version, three UTF strings, the configuration fields, and the edit-distance identifier) the attacker pays
    no meaningful size cost to weaponize a payload: a file of well under 100 bytes plus a single real entry is
    sufficient to crash a JVM that loads it. Any code path that deserializes a SymSpell model is affected,
    including SymSpellModels.deserialize(InputStream), SymSpellModels.fromBytes(byte[]), classpath model
    loading via SymSpellModelResolver.resolveByLanguage(String), the CorrectTextTool command-line tool, and
    model-archive loading through the registered ArtifactSerializer. The opennlp-spellcheck extension ships in
    the official OpenNLP binary distribution. The practical impact is denial of service against processes that
    load SymSpell model files from untrusted or semi-trusted origins. Mitigation: - 3.x users should upgrade
    to 3.0.0-M6. Note: The fix applies an upper bound to both count fields, checked before the map is pre-
    sized; counts that are negative or exceed the bound cause an IOException to be thrown and the read to fail
    fast with no large allocation. The bound is the existing AbstractModelReader.MAX_ENTRIES limit introduced
    earlie, which the current change promotes to public visibility so that serializers implementing their own
    binary format can share it. The default bound is 10,000,000, which is well above the entry counts of
    legitimate SymSpell dictionaries but far below any value that would threaten heap exhaustion. Deployments
    that legitimately need to load larger dictionaries can raise the limit at JVM startup by setting the
    OPENNLP_MAX_ENTRIES system property to the desired positive integer (e.g. -DOPENNLP_MAX_ENTRIES=50000000);
    invalid or non-positive values fall back to the default. Note that this property is shared with the model-
    reader limit and raising it relaxes both. Users who cannot upgrade immediately should treat all SymSpell
    .bin model files as untrusted input unless their provenance is verified, and should avoid loading models
    supplied by end users or fetched from third-party repositories without integrity checks. (CVE-2026-67211)

Note that Nessus relies on the presence of the package as reported by the vendor.");
  script_set_attribute(attribute:"see_also", value:"https://ubuntu.com/security/CVE-2026-67211");
  script_set_attribute(attribute:"solution", value:
"There is no known solution at this time.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:U/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:U/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-67211");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:20.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:22.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:24.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:26.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:apache-opennlp");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl", "set_linux_os_id.nasl");
  script_require_keys("Host/cpu", "Host/local_checks_enabled", "global_settings/vendor_unpatched", "Host/OS/identifier");
  script_require_ports("Host/OS/Ubuntu Linux-20.04", "Host/OS/Ubuntu Linux-22.04", "Host/OS/Ubuntu Linux-24.04", "Host/OS/Ubuntu Linux-26.04");

  exit(0);
}

if (!get_kb_item("global_settings/vendor_unpatched")) exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (empty_or_null(get_one_kb_item("Host/Debian/dpkg-l"))) audit(AUDIT_PACKAGE_LIST_MISSING);

include('linux_unpatched.inc');

var distro_constraints_array = {
  "Ubuntu Linux-20.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "20.04",
        "pkgs": [
          {"reference": "apache-opennlp"}
        ]
      }
    ]
  },
  "Ubuntu Linux-22.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "22.04",
        "pkgs": [
          {"reference": "apache-opennlp"}
        ]
      }
    ]
  },
  "Ubuntu Linux-24.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "24.04",
        "pkgs": [
          {"reference": "apache-opennlp"}
        ]
      }
    ]
  },
  "Ubuntu Linux-26.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "26.04",
        "pkgs": [
          {"reference": "apache-opennlp"}
        ]
      }
    ]
  }
};

var distro_constraints_values = linux_unpatched::get_distro_constraints(distro_constraints_arr:distro_constraints_array);
if (empty_or_null(distro_constraints_values)) audit(AUDIT_HOST_NOT, 'affected');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (!empty_or_null(third_party_support)) {
    var third_party_vendors = distro_constraints_values['third_party'];
    if (!empty_or_null(third_party_vendors)) {
        var vendor;
        foreach vendor (third_party_vendors) {
            if (vendor == third_party_support) exit(0, 'A third party management patch is available for this vulnerability from ' + vendor + '.\n');
        }
    }
}

var report = linux_unpatched::check_unpatched_constraints(distro_constraints_values:distro_constraints_values);

if (!empty_or_null(report))
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : report
  );
  exit(0);
}
else
{
  audit(AUDIT_HOST_NOT, 'affected');
}