According to the versions of the mod_http2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an     informative HTTP 413 response. If a client does not stop sending headers, this leads to memory     exhaustion.(CVE-2024-27316)

Tenable has extracted the preceding description block directly from the EulerOS mod_http2 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators     to split HTTP responses.(CVE-2023-38709)

    HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject     malicious response headers into backend applications to cause an HTTP desynchronization attack.Users are     recommended to upgrade to version 2.4.59, which fixes this issue.(CVE-2024-24795)

    HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an     informative HTTP 413 response. If a client does not stop sending headers, this leads to memory     exhaustion.(CVE-2024-27316)

Tenable has extracted the preceding description block directly from the EulerOS httpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators     to split HTTP responses.(CVE-2023-38709)

    HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject     malicious response headers into backend applications to cause an HTTP desynchronization attack.

    Users are recommended to upgrade to version 2.4.59, which fixes this issue.(CVE-2024-24795)

    HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an     informative HTTP 413 response. If a client does not stop sending headers, this leads to memory     exhaustion.(CVE-2024-27316)

Tenable has extracted the preceding description block directly from the EulerOS httpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1786 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    Security Fix(es):

    * httpd: mod_http2: CONTINUATION frames DoS (CVE-2024-27316)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5662 advisory.

  - Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server:
    through 2.4.57. (CVE-2023-31122)

  - Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators     to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58. (CVE-2023-38709)

  - An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of     that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the     server, similar to the well known slow loris attack pattern. This has been fixed in version 2.4.58, so     that such connection are terminated properly after the configured connection timeout. This issue affects     Apache HTTP Server: from 2.4.55 through 2.4.57. Users are recommended to upgrade to version 2.4.58, which     fixes the issue. (CVE-2023-43622)

  - When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory     resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A     client could send new requests and resets, keeping the connection busy and open and causing the memory     footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run     out of memory before that. This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid     Reset Exploit) with their own test client. During normal HTTP/2 use, the probability to hit this bug is     very low. The kept memory would not become noticeable before the connection closes or times out. Users are     recommended to upgrade to version 2.4.58, which fixes the issue. (CVE-2023-45802)

  - HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject     malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are     recommended to upgrade to version 2.4.59, which fixes this issue. (CVE-2024-24795)

  - HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an     informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.
    (CVE-2024-27316)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2024:1872 advisory.

  - HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an     informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.
    (CVE-2024-27316)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-528301bac2 advisory.

    Security fix for CVE-2024-27316


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-595 advisory.

    HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an     informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.
    (CVE-2024-27316)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable Security Center running on the remote host is prior to 6.4.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2024-10 advisory.

  - Security Center leverages third-party software to help provide underlying functionality. Several of the     third-party components (Apache, PHP) were found to contain vulnerabilities, and updated versions have been     made available by the providers.Out of caution and in line with best practice, Tenable has opted to     upgrade these components to address the potential impact of the issues. Security Center 6.4.0 updates     Apache to version 2.4.59 and PHP to version 8.2.13 to address the identified vulnerabilities.Additionally,     two separate vulnerabilities were discovered, reported and fixed:A stored cross site scripting     vulnerability exists in Tenable Security Center where an authenticated, remote attacker could inject HTML     code into a web application scan result page. - CVE-2024-1891An improper privilege management     vulnerability exists in Tenable Security Center where an authenticated, remote attacker could view     unauthorized objects and launch scans without having the required privileges. - CVE-2024-5759 Tenable has     released Security Center 6.4.0 to address these issues. The installation files can be obtained from the     Tenable Downloads Portal: https://www.tenable.com/downloads/security-center (CVE-2023-38709,     CVE-2024-1874, CVE-2024-1891, CVE-2024-24795, CVE-2024-27316, CVE-2024-3096, CVE-2024-5759)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an     informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.
    (CVE-2024-27316)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0665 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-38709:
    Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators     to split HTTP responses.

    This issue affects Apache HTTP Server: through 2.4.58.

    CVE-2024-27316:
    HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an     informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

    CVE-2024-24795:
    HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject     malicious response headers into backend applications to cause an HTTP desynchronization attack.

    Users are recommended to upgrade to version 2.4.59, which fixes this issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of httpd / mod_http2 installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-27316 advisory.

  - HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an     informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.
    (CVE-2024-27316)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 14.x prior to 14.6. It is, therefore, affected by multiple vulnerabilities:

  - A race condition in sshd affecting versions between 8.5p1 and 9.7p1 (inclusive) may allow arbitrary code     execution with root privileges. Successful exploitation has been demonstrated on 32-bit Linux/glibc     systems with ASLR. According to OpenSSH, the attack has been tested under lab conditions and requires on     average 6-8 hours of continuous connections up to the maximum the server will accept. Exploitation on     64-bit systems is believed to be possible but has not been demonstrated at this time.  (CVE-2024-6387)

  - A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition     which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be     able to trigger it by failing to authenticate within a set time period. (CVE-2024-6387)

  - Use after free in ANGLE in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2024-4558)

  - A race condition was addressed with improved locking. This issue is fixed in macOS Ventura 13.3. An app     may bypass Gatekeeper checks. (CVE-2023-27952)

  - Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators     to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58. (CVE-2023-38709)

Note that Nessus has not tested for these issues but has instead relied only on the operating system's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
205906	EulerOS 2.0 SP12 : mod_http2 (EulerOS-SA-2024-2220)	Nessus	Huawei Local Security Checks	2024/8/20	2024/8/20	high
202449	EulerOS 2.0 SP10 : httpd (EulerOS-SA-2024-1910)	Nessus	Huawei Local Security Checks	2024/7/15	2024/7/15	high
202974	EulerOS 2.0 SP8 : httpd (EulerOS-SA-2024-2035)	Nessus	Huawei Local Security Checks	2024/7/22	2024/7/22	high
193231	RHEL 8 : httpd:2.4/mod_http2 (RHSA-2024:1786)	Nessus	Red Hat Local Security Checks	2024/4/11	2025/3/6	high
193369	Debian dsa-5662 : apache2 - security update	Nessus	Debian Local Security Checks	2024/4/16	2024/7/12	high
193499	AlmaLinux 9 : mod_http2 (ALSA-2024:1872)	Nessus	Alma Linux Local Security Checks	2024/4/18	2024/4/18	high
193672	Fedora 39 : mod_http2 (2024-528301bac2)	Nessus	Fedora Local Security Checks	2024/4/21	2024/11/14	high
194498	Amazon Linux 2023 : mod_http2 (ALAS2023-2024-595)	Nessus	Amazon Linux Local Security Checks	2024/4/29	2024/12/11	high
200260	Tenable Security Center < 6.4.0 Multiple Vulnerabilities (TNS-2024-10)	Nessus	Misc.	2024/6/10	2024/8/2	medium
228309	Linux Distros Unpatched Vulnerability : CVE-2024-27316	Nessus	Misc.	2025/3/5	2026/7/18	high
239621	TencentOS Server 4: httpd (TSSA-2024:0665)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	high
215249	Azure Linux 3.0 Security Update: httpd / mod_http2 (CVE-2024-27316)	Nessus	Azure Linux Local Security Checks	2025/2/10	2025/9/15	high
207226	macOS 14.x < 14.6 Multiple Vulnerabilities (120911)	Nessus	MacOS X Local Security Checks	2024/9/13	2025/3/24	critical

检测

插件搜索

high

high

high

high

high

high

high

high

medium

high

high

high

critical