The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:30845 advisory.

    This module manages common properties of domains for one or more virtual hosts. Specifically it can use     the ACME protocol to automate certificate provisioning.  Certificates will be configured for managed     domains and their virtual hosts automatically, including at renewal.

    Security Fix(es):

    * httpd: mod_md: unrestricted OCSP response leads to resource exhaustion (CVE-2026-29168)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:30845 advisory.

    * httpd: mod_md: unrestricted OCSP response leads to resource exhaustion (CVE-2026-29168)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4571 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4571-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     May 08, 2026                                  https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : apache2     Version        : 2.4.67-1~deb11u1     CVE ID         : CVE-2026-24072 CVE-2026-28780 CVE-2026-29168 CVE-2026-29169                      CVE-2026-33006 CVE-2026-33007 CVE-2026-33523 CVE-2026-33857                      CVE-2026-34032 CVE-2026-34059     Debian Bug     : 1135737

    Multiple vulnerabilities have been discovered in the Apache HTTP server,     which may result in remote code execution, privilege escalation, denial     of service or information disclosure.

    An erratum was issued because DLA??4571??1 incorrectly marked CVE??2026??28780     and CVE??2026??29168 as not fixed.

    These two vulnerabilities are in fact addressed in version 2.4.67??1~deb11u1,     which includes the required security fixes.

    Additionally, CVE??2026??23918 was marked as not affecting Bullseye, as the     vulnerable code is not present in any previously released Bullseye packages.
    However, the updated package includes the fix for this issue as well,     even though it does not impact this release.

    For Debian 11 bullseye, these problems have been fixed in version     2.4.67-1~deb11u1.

    We recommend that you upgrade your apache2 packages.

    For the detailed security status of apache2 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/apache2

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's   mod_md via     OCSP response data.

    This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66.

    Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-29168)

    An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess     authors to read files with the privileges of the httpd user.

    Users are recommended to upgrade to version 2.4.67, which fixes this issue.(CVE-2026-24072)

    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker     to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs.

    The only known use-case for mod_dav_lock was mod_dav_svn from Apache Subversion earlier than version     1.2.0.

    Users are recommended to upgrade to version 2.4.66, which fixes this issue, or remove     mod_dav_lock.(CVE-2026-29169)

    Buffer Over-read vulnerability in Apache HTTP Server.

    This issue affects Apache HTTP Server: through 2.4.66.

    Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-34059)

    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back     to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer.

    This issue affects Apache HTTP Server: through 2.4.66.

    Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-28780)

Tenable has extracted the preceding description block directly from the EulerOS httpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:27200 advisory.

    Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This     software, such as Apache HTTP Server, is common to multiple JBoss middleware products and packaged under     Red Hat JBoss Core Services, to allow for faster distribution of updates and for a more consistent update     experience.

    This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4 serves as a     replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 3, and includes bug     fixes and enhancements, which are documented in the Release Notes linked to in the References section.

    Security Fix(es):

    * jbcs-httpd24-httpd: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer     overflow (CVE-2026-28780)
    * jbcs-httpd24-httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack     (CVE-2026-49975)
    * jbcs-httpd24-mod_http2: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack     (CVE-2026-49975)
    * mod_proxy_ajp.so: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032)
    * mod_proxy_ajp.so: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059)
    * mod_authn_socache.so: NULL pointer dereference can cause a child process crash (CVE-2026-33007)
    * mod_proxy_ajp.so: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857)
    * mod_dav_lock.so: NULL pointer dereference via specially crafted request (CVE-2026-29169)
    * jbcs-httpd24-mod_md: unrestricted OCSP response leads to resource exhaustion (CVE-2026-29168)
    * jbcs-httpd24-httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020)
    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    A Red Hat Security Bulletin which addresses further details about this flaw is available in the References     section.

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
323860	RHEL 10 : mod_md (RHSA-2026:30845)	Nessus	Red Hat Local Security Checks	2026/6/30	2026/6/30	high
323942	AlmaLinux 10 : mod_md (ALSA-2026:30845)	Nessus	Alma Linux Local Security Checks	2026/6/30	2026/6/30	high
313221	Debian dla-4571 : apache2 - security update	Nessus	Debian Local Security Checks	2026/5/8	2026/5/14	critical
326642	EulerOS 2.0 SP10 : httpd (EulerOS-SA-2026-2693)	Nessus	Huawei Local Security Checks	2026/7/14	2026/7/14	high
321959	RHEL 7 / 8 : Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP4 (RHSA-2026:27200)	Nessus	Red Hat Local Security Checks	2026/6/22	2026/7/3	high

检测

插件搜索

high

high

critical

high

high