The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23732 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    Security Fix(es):

    * httpd: Apache HTTP Server: CGI environment variable override (CVE-2025-65082)

    * mod_md: Apache HTTP Server: mod_md (ACME), unintended retry intervals (CVE-2025-55753)

    * httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200)

    * httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of httpd installed on the remote host is prior to 2.4.66-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3099 advisory.

    An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30     days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then     are repeated without delays until it succeeds.

    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.

    Users are recommended to upgrade to version 2.4.66, which fixes the issue. (CVE-2025-55753)

    Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not     mod_cgi) passes the shell-escaped query string to #exec cmd=... directives. (CVE-2025-58098)

    Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through     environment variables set via the Apache configuration unexpectedly superseding variables calculated by     the server for CGI programs.

    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.

    Users are recommended to upgrade to version 2.4.66 which fixes the issue. (CVE-2025-65082)

    mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with     access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an     unexpected userid. (CVE-2025-66200)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:0090 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    Security Fix(es):

    * httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:0141 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    Security Fix(es):

    * httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not     mod_cgi) passes the shell-escaped query string to #exec cmd='...' directives.(CVE-2025-58098)

    mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with     access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an     unexpected userid.(CVE-2025-66200)

    Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through     environment variables set via the Apache configuration unexpectedly superseding variables calculated by     the server for CGI programs.(CVE-2025-65082)

Tenable has extracted the preceding description block directly from the EulerOS httpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not     mod_cgi) passes the shell-escaped query string to #exec cmd='...' directives.This issue affects Apache     HTTP Server before 2.4.66.Users are recommended to upgrade to version 2.4.66, which fixes the     issue.(CVE-2025-58098)

    Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through     environment variables set via the Apache configuration unexpectedly superseding variables calculated by     the server for CGI programs.This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.Users are     recommended to upgrade to version 2.4.66 which fixes the issue.(CVE-2025-65082)

    mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with     access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an     unexpected userid.This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65.Users are recommended     to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-66200)

Tenable has extracted the preceding description block directly from the EulerOS httpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not     mod_cgi) passes the shell-escaped query string to #exec cmd='...' directives.

    This issue affects Apache HTTP Server before 2.4.66.

    Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-58098)

    Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through     environment variables set via the Apache configuration unexpectedly superseding variables calculated by     the server for CGI programs.

    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.

    Users are recommended to upgrade to version 2.4.66 which fixes the issue.(CVE-2025-65082)

    mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with     access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an     unexpected userid.

    This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65.

    Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-66200)

Tenable has extracted the preceding description block directly from the EulerOS httpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0012 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

    CVE-2025-58098:
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not     mod_cgi) passes the shell-escaped query string to #exec cmd=... directives.

    This issue affects Apache HTTP Server before 2.4.66.

    Users are recommended to upgrade to version 2.4.66, which fixes the issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202608-05 (Apache HTTPD: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Apache HTTPD. Please review the CVE identifiers     referenced below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1767970357 advisory.

  - Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not     mod_cgi) passes the shell-escaped query string to #exec cmd=... directives. This issue affects Apache     HTTP Server before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.
    (CVE-2025-58098)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has httpd packages installed that are affected by a vulnerability:

  - Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not     mod_cgi) passes the shell-escaped query string to #exec cmd=... directives. This issue affects Apache     HTTP Server before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.
    (CVE-2025-58098)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2025_23919 advisory.

    * httpd: Apache HTTP Server: CGI environment variable override (CVE-2025-65082)

    * httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200)

    * httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
279514	RHEL 8 : httpd:2.4 (RHSA-2025:23732)	Nessus	Red Hat Local Security Checks	2025/12/22	2025/12/22	high
281819	Amazon Linux 2 : httpd, --advisory ALAS2-2025-3099 (ALAS-2025-3099)	Nessus	Amazon Linux Local Security Checks	2026/1/5	2026/1/5	high
281854	RHEL 9 : httpd (RHSA-2026:0090)	Nessus	Red Hat Local Security Checks	2026/1/6	2026/1/6	high
281896	RHEL 9 : httpd (RHSA-2026:0141)	Nessus	Red Hat Local Security Checks	2026/1/6	2026/1/6	high
301637	EulerOS 2.0 SP13 : httpd (EulerOS-SA-2026-1278)	Nessus	Huawei Local Security Checks	2026/3/10	2026/3/10	high
302588	EulerOS 2.0 SP11 : httpd (EulerOS-SA-2026-1609)	Nessus	Huawei Local Security Checks	2026/3/16	2026/3/16	high
302449	EulerOS 2.0 SP12 : httpd (EulerOS-SA-2026-1396)	Nessus	Huawei Local Security Checks	2026/3/16	2026/3/16	high
284646	TencentOS Server 2: httpd (TSSA-2026:0012)	Nessus	Tencent Local Security Checks	2026/1/14	2026/1/14	high
335265	GLSA-202608-05 : Apache HTTPD: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2026/8/13	2026/8/17	high
361094	CentOS Linux 7 [TuxCare] Security Update: httpd / httpd-devel / httpd-manual / httpd-tools / mod_ldap / etc (CENTOS7:CLSA-2026:1767970357)	Nessus	CentOS Local Security Checks	2026/10/1	2026/10/1	high
343591	NewStart CGSL MAIN 7.02 : httpd Vulnerability (NS-SA-2026-0094)	Nessus	NewStart CGSL Local Security Checks	2026/9/8	2026/9/8	high
356233	Rocky Linux 9 [CIQ] Security Update: httpd / httpd-core / httpd-core-debuginfo / httpd-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_23919)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high