The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:69097 advisory.

    Rust is a systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread     safety.  This package includes the Rust compiler and documentation generator.

    Security Fix(es):

    * libgit2: libgit2: Denial of Service due to heap out-of-bounds read from malicious Git server     (CVE-2026-53587)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2064 advisory.

    libgit2 Submodule path traversal (CVE-2026-53584)

    Unbounded Memory Allocation via Delta Object Result-Size Header (CVE-2026-53585)

    libgit2 version 1.9.4 and below is vulnerable to a heap out-of-bounds read in set_data() in     src/libgit2/transports/smart_pkt.c.

    The vulnerable code uses a fixed-size strncmp (smart_pkt.c:239) against the unvalidated capability buffer     of a smart-protocol pkt-line. When the bytes following the pkt-line in the contiguous receive buffer     happen to continue with ct-format=, the comparison spuriously matches, advancing format_str past the     pkt-line boundary. The following memchr(format_str, ' ', len - (format_str - line)) (smart_pkt.c:246) then     underflows its size_t size argument to ~SIZE_MAX and walks the heap looking for a space byte. An     unauthenticated remote attacker who controls (or man-in-the-middles) a Git server reached over     HTTP/HTTPS/SSH/git:// can trigger this on the FIRST ref-pkt of the refs advertisement, before any     capability negotiation has taken place. The OOB walk causes a process crash (SIGSEGV) when memchr enters     an unmapped page, and -- on heap layouts where memchr finds a stray space byte before crashing -- can     additionally drive the git_error_set(...'%.*s', format_len, format_str) formatter to copy a large window     of heap memory into the error string. (CVE-2026-53587)

    libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open()     function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client     opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the     response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error     such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache     dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.
    (CVE-2026-66032)

    libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow     vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to     crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit the     underflow in the expression computing blocksize minus aadlen minus authentication tag length to trigger an     out-of-bounds read and a memcpy call with a near-SIZE_MAX length argument, causing immediate process crash     before any authentication occurs. (CVE-2026-66033)

    libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows     a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an     uninitialized pointer via the publickey subsystem. In libssh2_publickey_list_fetch(), the version 1     response parser reads a server-controlled comment_len value and advances the parse pointer without     verifying sufficient bytes remain in the buffer, causing the out-of-bounds read to leak heap pointers from     adjacent allocations defeating ASLR, followed by heap allocator state corruption when the error cleanup     path frees an uninitialized pointer from a non-zeroed realloc() region. (CVE-2026-66034)

    libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow     vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by     sending a packet with a packet_length smaller than the cipher's block size during Encrypt-then-MAC cipher     negotiation. In the fullpacket() function in src/transport.c, the ETM path allocates a buffer of     packet_length bytes but copies blocksize minus one bytes via memcpy, causing an overflow that on 32-bit     glibc writes attacker-controlled bytes into an adjacent chunk's SIZE field, enabling tcache bin confusion,     overlapping live objects, and function pointer overwrite during the session handshake before     authentication. (CVE-2026-66035)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-9d59721e9b advisory.

    - Update libgit2 to version 1.9.6.
    - Update the libgit2-sys Rust crate to the corresponding version 0.18.7.

    This includes fixes for various security issues, including - but not limited to:

    - [CVE-2026-53583](https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp)
    - [CVE-2026-53584](https://github.com/libgit2/libgit2/security/advisories/GHSA-cw77-j82w-mchm)
    - [CVE-2026-53585](https://github.com/libgit2/libgit2/security/advisories/GHSA-27m5-gxxh-x79j)
    - [CVE-2026-53586](https://github.com/libgit2/libgit2/security/advisories/GHSA-2889-x8f6-mc4x)
    - [CVE-2026-53587](https://github.com/libgit2/libgit2/security/advisories/GHSA-pm24-4jhq-3xvm)

    The Fedora package is not affected by [GHSA-     wfx7-g85r-q6vw](https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp) since Fedora     packages always linked the system PCRE2 and did not use the bundled PCRE.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2065 advisory.

    rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80,     CipherCtxRef::cipher_update_inplace in openssl/src/cipher_ctx.rs incorrectly sized output buffers when     used with AES key-wrap-with-padding ciphers EVP_aes_{128,192,256}_wrap_pad. For a non-multiple-of-8 input,     OpenSSL writes up to 7 bytes past the end of the caller's buffer or Vec, producing attacker-controllable     heap corruption when the plaintext length is attacker-influenced. This issue is fixed in version 0.10.80.
    (CVE-2026-45784)

    RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to     execute in constant-time and not be rewritten as branches by the compiler. From 0.1.1 until 0.5.4, the     aarch64 implementations of Cmov and CmovEq in cmov/src/backends/aarch64.rs assume high bits are zero-     extended when loading values smaller than a register, so set high bits such as [8..] in a Cmov selector or     [16..] of self or other in the u16 and i16 CmovEq implementations can cause left.cmovz(&right, condition)     to produce incorrect output. This issue is fixed in version 0.5.4. (CVE-2026-50185)

    libgit2 Inverted IP SubjectAltName Comparison in OpenSSL Backend ( vuln_1_1_1 ) (CVE-2026-53583)

    libgit2 Submodule path traversal (CVE-2026-53584)

    Unbounded Memory Allocation via Delta Object Result-Size Header (CVE-2026-53585)

    libgit2's builtin HTTP transport follows offsite redirects for the initial smart HTTP request by default.
    If the redirected server then returns 401 Unauthorized, libgit2 asks the application credential callback     for credentials using the original remote URL, not the redirected URL. The returned credential is then     attached to the next request to the redirected host as an Authorization header. (CVE-2026-53586)

    libgit2 version 1.9.4 and below is vulnerable to a heap out-of-bounds read in set_data() in     src/libgit2/transports/smart_pkt.c.

    The vulnerable code uses a fixed-size strncmp (smart_pkt.c:239) against the unvalidated capability buffer     of a smart-protocol pkt-line. When the bytes following the pkt-line in the contiguous receive buffer     happen to continue with ct-format=, the comparison spuriously matches, advancing format_str past the     pkt-line boundary. The following memchr(format_str, ' ', len - (format_str - line)) (smart_pkt.c:246) then     underflows its size_t size argument to ~SIZE_MAX and walks the heap looking for a space byte. An     unauthenticated remote attacker who controls (or man-in-the-middles) a Git server reached over     HTTP/HTTPS/SSH/git:// can trigger this on the FIRST ref-pkt of the refs advertisement, before any     capability negotiation has taken place. The OOB walk causes a process crash (SIGSEGV) when memchr enters     an unmapped page, and -- on heap layouts where memchr finds a stray space byte before crashing -- can     additionally drive the git_error_set(...'%.*s', format_len, format_str) formatter to copy a large window     of heap memory into the error string. (CVE-2026-53587)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2083 advisory.

    libgit2 Inverted IP SubjectAltName Comparison in OpenSSL Backend ( vuln_1_1_1 ) (CVE-2026-53583)

    libgit2 Submodule path traversal (CVE-2026-53584)

    Unbounded Memory Allocation via Delta Object Result-Size Header (CVE-2026-53585)

    libgit2's builtin HTTP transport follows offsite redirects for the initial smart HTTP request by default.
    If the redirected server then returns 401 Unauthorized, libgit2 asks the application credential callback     for credentials using the original remote URL, not the redirected URL. The returned credential is then     attached to the next request to the redirected host as an Authorization header. (CVE-2026-53586)

    libgit2 version 1.9.4 and below is vulnerable to a heap out-of-bounds read in set_data() in     src/libgit2/transports/smart_pkt.c.

    The vulnerable code uses a fixed-size strncmp (smart_pkt.c:239) against the unvalidated capability buffer     of a smart-protocol pkt-line. When the bytes following the pkt-line in the contiguous receive buffer     happen to continue with ct-format=, the comparison spuriously matches, advancing format_str past the     pkt-line boundary. The following memchr(format_str, ' ', len - (format_str - line)) (smart_pkt.c:246) then     underflows its size_t size argument to ~SIZE_MAX and walks the heap looking for a space byte. An     unauthenticated remote attacker who controls (or man-in-the-middles) a Git server reached over     HTTP/HTTPS/SSH/git:// can trigger this on the FIRST ref-pkt of the refs advertisement, before any     capability negotiation has taken place. The OOB walk causes a process crash (SIGSEGV) when memchr enters     an unmapped page, and -- on heap layouts where memchr finds a stray space byte before crashing -- can     additionally drive the git_error_set(...'%.*s', format_len, format_str) formatter to copy a large window     of heap memory into the error string. (CVE-2026-53587)

    libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a     shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH     server by supplying a repository path containing unescaped shell metacharacters such as single quotes,     semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into     a shell command string without escaping special characters before passing it to libssh2_channel_exec(),     enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during     a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH     user account. (CVE-2026-5917)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2026_67286 advisory.

    * libgit2: libgit2: Denial of Service due to heap out-of-bounds read from malicious Git server     (CVE-2026-53587)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790157025 advisory.

  - libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid     API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs     a fixed-size strncmp in set_data in src/libgit2/transports/smart_pkt.c without first verifying that the     smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can make bytes after     the pkt-line complete object-format=, causing format_str to advance beyond the pkt-line and the following     memchr length calculation to underflow. The resulting heap out-of-bounds walk can crash a client during     the first refs-advertisement packet over HTTP, HTTPS, SSH, or the Git protocol. This issue is fixed in     versions 1.8.6 and 1.9.5. (CVE-2026-53587)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-7c3fc14617 advisory.

    - Update libgit2 to version 1.9.6.
    - Update the libgit2-sys Rust crate to the corresponding version 0.18.7.

    This includes fixes for various security issues, including - but not limited to:

    - [CVE-2026-53583](https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp)
    - [CVE-2026-53584](https://github.com/libgit2/libgit2/security/advisories/GHSA-cw77-j82w-mchm)
    - [CVE-2026-53585](https://github.com/libgit2/libgit2/security/advisories/GHSA-27m5-gxxh-x79j)
    - [CVE-2026-53586](https://github.com/libgit2/libgit2/security/advisories/GHSA-2889-x8f6-mc4x)
    - [CVE-2026-53587](https://github.com/libgit2/libgit2/security/advisories/GHSA-pm24-4jhq-3xvm)

    The Fedora package is not affected by [GHSA-     wfx7-g85r-q6vw](https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp) since Fedora     packages always linked the system PCRE2 and did not use the bundled PCRE.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
348369	RHEL 9 : rust (RHSA-2026:69097)	Nessus	Red Hat Local Security Checks	2026/9/21	2026/9/21	high
337216	Amazon Linux 2023 : cargo-c (ALAS2023-2026-2064)	Nessus	Amazon Linux Local Security Checks	2026/8/18	2026/8/18	high
330052	Fedora 44 : libgit2 / rust-libgit2-sys (2026-9d59721e9b)	Nessus	Fedora Local Security Checks	2026/7/26	2026/8/24	medium
337244	Amazon Linux 2023 : cargo, clippy, rust (ALAS2023-2026-2065)	Nessus	Amazon Linux Local Security Checks	2026/8/18	2026/8/20	medium
341845	Amazon Linux 2023 : libgit2, libgit2-devel (ALAS2023-2026-2083)	Nessus	Amazon Linux Local Security Checks	2026/8/31	2026/9/18	high
354423	Rocky Linux 10.2 [CIQ] Security Update: cargo / cargo-debuginfo / clippy / clippy-debuginfo / rust / etc (crlsa-2026_67286)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
360729	Rocky Linux 9.6 [TuxCare] Security Update: cargo / clippy / rust / rust-analyzer / rust-debugger-common / etc (ALMALINUX9.6:CLSA-2026:1790157025)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
329273	Fedora 45 : libgit2_1.9 / rust-libgit2-sys (2026-7c3fc14617)	Nessus	Fedora Local Security Checks	2026/7/23	2026/8/24	medium

检测

插件搜索

high

high

medium

medium

high

high

high

medium