Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - NGINX Plus 和 NGINX Open Source 在 ngx_http_charset_module 模組中存在弱點。當設定了具有停用緩衝 （off） 指令的字元集、source_charset 以及 charset_map 和 proxy_pass時，未經身份驗證的攻擊者可以發送具有攻擊者無法控制的條件的請求，從而導致 NGINX 工作進程中的堆積緩衝區過度讀取，從而導致記憶體洩露有限或重新啟動。
    注意：不會評估已達到技術支援終止 (EoTS) 的軟體版本。
    (CVE-2026-42934)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - NGINX Plus 和 NGINX Open Source 在 ngx_http_charset_module 模块中存在一个漏洞。当配置了带有禁用缓冲区 （off） 指令的字符集、source_charset、charset_map和proxy_pass时，未经身份验证的攻击者可发送条件超出攻击者控制范围的请求，造成 NGINX 工作进程中的堆缓冲区过度读取，从而导致有限的内存泄露或重启。
    注意：不评估已达到技术支持结束日期 (EoTS) 的软件版本。
    (CVE-2026-42934)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - NGINX PlusとNGINX Open Sourceには、ngx_http_charset_moduleモジュールに脆弱性があります。charset、source_charset、バッファリングが無効(off)ディレクティブcharset_map proxy_passが設定されている場合、認証されていない攻撃者が、攻撃者が制御できない条件でリクエストを送信し、NGINXワーカープロセスでヒープバッファオーバーリードを引き起こし、メモリの限定的な漏えいや再起動を引き起こす可能性があります。
    注意: テクニカルサポートの終了 (EoTS) に達したソフトウェアのバージョンは評価されていません。
    (CVE-2026-42934)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 3414ac89-4f9f-11f1-a1c0-0050569f0b83 advisory.

    nginx development team reports:
    When using the proxy_set_body directive, an attacker               might inject data in the proxied request to an HTTP/2 backend     A heap memory buffer overflow might occur in a worker               process while handling a specially crafted request by               ngx_http_rewrite_module, potentially resulting in arbitrary code               execution     A heap memory buffer overread might occur in a worker               process while handling a specially crafted response by               ngx_http_scgi_module or ngx_http_uwsgi_module, allowing an attacker               to cause a disclosure of worker process memory or segmentation fault               in a worker process     A heap memory buffer overread might occur in a worker               process while handling a specially sent response with decoding from               UTF-8 via the charset_map directive, allowing an attacker to cause               a limited disclosure of worker proccess memory or segmentation fault               in a worker process     When using HTTP/3, processing of connection migration might               cause new QUIC streams to receive a new client address before               validation, allowing an attacker to cause address spoofing     use-after-free might occur during DNS server response               processing if the ssl_ocsp directive was used, allowing an attacker               to cause worker process memory corruption or segmentation fault in a               worker process

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset,     source_charset, and charset_map and proxy_pass with disabled buffering (off) directives are configured,     unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a     heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.
    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-42934)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
314522	Linux Distros 未修補的弱點：CVE-2026-42934	Nessus	Misc.	2026/5/14	2026/5/15	medium
314522	Linux Distros 未修补的漏洞：CVE-2026-42934	Nessus	Misc.	2026/5/14	2026/5/15	medium
314522	Linux Distros のパッチ未適用の脆弱性: CVE-2026-42934	Nessus	Misc.	2026/5/14	2026/5/15	medium
314915	FreeBSD : www/nginx -- Remote Code Execution/DoS (3414ac89-4f9f-11f1-a1c0-0050569f0b83)	Nessus	FreeBSD Local Security Checks	2026/5/15	2026/5/15	critical
314522	Linux Distros Unpatched Vulnerability : CVE-2026-42934	Nessus	Misc.	2026/5/14	2026/5/15	medium

检测

插件搜索

medium

medium

medium

critical

medium