The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0743 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.3.16 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 7.3.15, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 7.3.16 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * UNDERTOW-2429 undertow: Improper State Management in Proxy Protocol parsing causes information leakage     [eap-7.3.z] (CVE-2024-7885)

    * jackson-core: jackson-core Potential StackoverflowError [eap-7.3.z] (CVE-2025-52999)

    * netty-codec-http2: Netty MadeYouReset HTTP/2 DDoS Vulnerability [eap-7.3.z] (CVE-2025-55163)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgements, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Atlassian Jira Service Management Data Center and Server (Jira Service Desk) running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16456 advisory.

  - Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and     4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2     protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit -     which results in resource exhaustion and distributed denial of service. This issue has been patched in     versions 4.1.124.Final and 4.2.4.Final. (CVE-2025-55163)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:17317 advisory.

    Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly     application runtime.

    This asynchronous patch is an update for Red Hat JBoss Enterprise Application Platform 8.0. See Release     Notes for information about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * netty-codec-http2: Netty MadeYouReset HTTP/2 DDoS Vulnerability (CVE-2025-55163)

    * netty-codec-http: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions     [eap-8.0.z] (CVE-2025-58056)

    * cxf: CXF JMS Code Execution Vulnerability (CVE-2025-48913)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and     4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2     protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit -     which results in resource exhaustion and distributed denial of service. This issue has been patched in     versions 4.1.124.Final and 4.2.4.Final. (CVE-2025-55163)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 12 / 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6160 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6160-1                   security@debian.org     https://www.debian.org/security/                          Markus Koschany     March 11, 2026                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : netty     CVE ID         : CVE-2025-55163 CVE-2025-58056 CVE-2025-58057 CVE-2025-59419                      CVE-2025-67735 CVE-2024-29025     Debian Bug     : 1068110 1111105 1113995 1113994 1118282 1123606

    Several security vulnerabilities have been discovered in Netty, a Java NIO     client/server socket framework. It was found that Netty was vulnerable to the     MadeYouReset DDoS attack, a logical vulnerability in the HTTP/2 protocol     itself and programming errors which enabled request smuggling attacks.
    Additionally Netty contained an SMTP command injection vulnerability due to     insufficient input validation potentially allowing remote attackers to forge     arbitrary emails from trusted servers.

    The security update for bookworm also contains the fix for CVE-2024-29025.
    Julien Viet discovered that Netty was vulnerable to allocation of resources     without limits or throttling due to the accumulation of data in the     HttpPostRequestDecoder. This would allow an attacker to cause a denial of     service.


    For the oldstable distribution (bookworm), these problems have been fixed     in version 1:4.1.48-7+deb12u2.

    For the stable distribution (trixie), these problems have been fixed in     version 1:4.1.48-10+deb13u1.

    We recommend that you upgrade your netty packages.

    For the detailed security status of netty please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/netty

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2026 CPU advisory.

  - Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST (Jettison)).
    Supported versions that are affected are 17.0-26.2. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of Siebel CRM Integration. (CVE-2022-40149, CVE-2022-40150, CVE-2022-45685,     CVE-2022-45693, CVE-2023-1436, CVE-2026-28493, CVE-2026-28494, CVE-2026-28686, CVE-2026-28687,     CVE-2026-28688, CVE-2026-28689, CVE-2026-28690, CVE-2026-28691, CVE-2026-28692, CVE-2026-28693,     CVE-2026-30883, CVE-2026-30929, CVE-2026-30931, CVE-2026-30935, CVE-2026-30936)

  - Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Keyword Automation     (Netty)). Supported versions that are affected are 17.0-26.2. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of Siebel CRM Deployment. (CVE-2025-58056, CVE-2025-58057)

  - Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Event Publish and     Subscribe (Apache Kafka)). Supported versions that are affected are 17.0-26.2. Easily exploitable     vulnerability allows unauthenticated attacker with network access via TCP to compromise Siebel CRM     Integration. Successful attacks of this vulnerability can result in unauthorized access to critical data     or complete access to all Siebel CRM Integration accessible data. (CVE-2025-27817, CVE-2025-27818)

  - Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Event Publish and     Subscribe (jose4j)). Supported versions that are affected are 17.0-26.2. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of Siebel CRM Integration. (CVE-2023-51775, CVE-2024-29371)

  - Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Keyword Automation     (Apache Commons Lang)). Supported versions that are affected are 17.0-26.2. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM     Deployment. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial     denial of service (partial DOS) of Siebel CRM Deployment. (CVE-2025-48924)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
291325	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.3.16 (RHSA-2026:0743)	Nessus	Red Hat Local Security Checks	2026/1/19	2026/1/19	high
293771	Atlassian Jira Service Management Data Center and Server 10.3.x < 10.3.12 / 11.0.x < 11.1.0 (JSDSERVER-16456)	Nessus	Misc.	2026/1/20	2026/1/20	high
266416	RHEL 8 / 9 : Red Hat JBoss Enterprise Application Platform 8.0.9 (RHSA-2025:17317)	Nessus	Red Hat Local Security Checks	2025/10/2	2025/10/2	high
260011	Linux Distros Unpatched Vulnerability : CVE-2025-55163	Nessus	Misc.	2025/8/31	2026/4/29	high
301895	Debian dsa-6160 : libnetty-java - security update	Nessus	Debian Local Security Checks	2026/3/11	2026/3/11	high
309923	Oracle Siebel Server <= 26.2 (April 2026 CPU)	Nessus	Misc.	2026/4/23	2026/4/27	high

检测

插件搜索

high

high

high

high

high

high