Linux Distros Unpatched Vulnerability : CVE-2025-15468

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: If an application using the SSLCIPHERfind function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL...

OpenSSL 3.4.0 < 3.4.4 Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 3.4.4. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.4.4 advisory. - Issue summary: If an application using the SSLCIPHERfind function in a QUIC protocol client or server receives an unknown cipher sui...

OpenSSL 3.6.0 < 3.6.1 Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 3.6.1. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.6.1 advisory. - Issue summary: If an application using the SSLCIPHERfind function in a QUIC protocol client or server receives an unknown cipher sui...

OpenSSL 3.5.0 < 3.5.5 Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 3.5.5. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.5.5 advisory. - Issue summary: If an application using the SSLCIPHERfind function in a QUIC protocol client or server receives an unknown cipher sui...

OpenSSL 3.3.0 < 3.3.6 Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 3.3.6. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.3.6 advisory. - Issue summary: If an application using the SSLCIPHERfind function in a QUIC protocol client or server receives an unknown cipher sui...

UBUNTU-CVE-2025-15468

Issue summary: If an application using the SSLCIPHERfind function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL dereference occurs. Impact summary: A NULL pointer dereference leads to abnormal termination of the running process causing Denial of Servic...

Azure Linux 3.0 Security Update: hyperv-daemons (CVE-2019-10638)

The version of hyperv-daemons installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2019-10638 advisory. - In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the...

Azure Linux 3.0 Security Update: kata-containers (CVE-2025-4432)

The version of kata-containers installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-4432 advisory. - A flaw was found in Rust's Ring package. A panic May be triggered when overflow checking is enabled...

Azure Linux 3.0 Security Update: cmake (CVE-2024-2379)

The version of cmake installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-2379 advisory. - libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use...

CVE-2025-61684

Quicly, an IETF QUIC protocol implementation, is susceptible to a denial-of-service attack prior to commit d9d3df6a8530a102b57d840e39b0311ce5c9e14e. A remote attacker can exploit these bugs to trigger an assertion failure that crashes process using Quicly. Commit...

CVE-2025-61684 Quicly has assertion failures

Quicly, an IETF QUIC protocol implementation, is susceptible to a denial-of-service attack prior to commit d9d3df6a8530a102b57d840e39b0311ce5c9e14e. A remote attacker can exploit these bugs to trigger an assertion failure that crashes process using Quicly. Commit...

Curl 8.8.0 < 8.18.0 Improper Certificate Validation.

The version of curl installed on the remote host is missing a security update. It is, therefore, affected by an improper certificate validation vulnerability. - When using the CURLOPTPINNEDPUBLICKEY option with libcurl or --pinnedpubkey with the curl tool, the public key check should be performed...

CVE-2025-13034

When using CURLOPTPINNEDPUBLICKEY option with libcurl or --pinnedpubkey with the curl tool,curl should check the public key of the server certificate to verify the peer. This check was skipped in a certain condition that would then make curl allow the connection without performing the proper chec...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003767)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003767 advisory. In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols e.g., UDP and ICMP...

Astra Linux – Vulnerability in OpenSSL

Issue summary: If an application using the SSLCIPHERfind function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL pointer dereference occurs. Impact summary: A NULL pointer dereference leads to abnormal termination of the running process, causing a Denia...

CVE-2023-50247

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The QUIC stack quicly, as used by H2O up to commit 43f86e5 in version 2.3.0-beta and prior, is susceptible to a state exhaustion attack. When H2O is serving HTTP/3, a remote attacker can exploit this vulnerability to progressivel...

CVE-2023-50923

In QUIC in RFC 9000, the Latency Spin Bit specification section 17.4 does not strictly constrain the bit value when the feature is disabled, which might allow remote attackers to construct a covert channel with data represented as changes to the bit value. NOTE: The "Sheridan, S., Keane, A. 2015...

ALPINE-CVE-2025-13034

When using CURLOPTPINNEDPUBLICKEY option with libcurl or --pinnedpubkey with the curl tool,curl should check the public key of the server certificate to verify the peer. This check was skipped in a certain condition that would then make curl allow the connection without performing the proper chec...

CVE-2025-13034

When using CURLOPTPINNEDPUBLICKEY option with libcurl or --pinnedpubkey with the curl tool,curl should check the public key of the server certificate to verify the peer. This check was skipped in a certain condition that would then make curl allow the connection without performing the proper chec...

CVE-2025-13034

When using CURLOPTPINNEDPUBLICKEY option with libcurl or --pinnedpubkey with the curl tool,curl should check the public key of the server certificate to verify the peer. This check was skipped in a certain condition that would then make curl allow the connection without performing the proper chec...