The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2026_67286 advisory.

    * libgit2: libgit2: Denial of Service due to heap out-of-bounds read from malicious Git server     (CVE-2026-53587)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790157025 advisory.

  - libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid     API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs     a fixed-size strncmp in set_data in src/libgit2/transports/smart_pkt.c without first verifying that the     smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can make bytes after     the pkt-line complete object-format=, causing format_str to advance beyond the pkt-line and the following     memchr length calculation to underflow. The resulting heap out-of-bounds walk can crash a client during     the first refs-advertisement packet over HTTP, HTTPS, SSH, or the Git protocol. This issue is fixed in     versions 1.8.6 and 1.9.5. (CVE-2026-53587)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-7c3fc14617 advisory.

    - Update libgit2 to version 1.9.6.
    - Update the libgit2-sys Rust crate to the corresponding version 0.18.7.

    This includes fixes for various security issues, including - but not limited to:

    - [CVE-2026-53583](https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp)
    - [CVE-2026-53584](https://github.com/libgit2/libgit2/security/advisories/GHSA-cw77-j82w-mchm)
    - [CVE-2026-53585](https://github.com/libgit2/libgit2/security/advisories/GHSA-27m5-gxxh-x79j)
    - [CVE-2026-53586](https://github.com/libgit2/libgit2/security/advisories/GHSA-2889-x8f6-mc4x)
    - [CVE-2026-53587](https://github.com/libgit2/libgit2/security/advisories/GHSA-pm24-4jhq-3xvm)

    The Fedora package is not affected by [GHSA-     wfx7-g85r-q6vw](https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp) since Fedora     packages always linked the system PCRE2 and did not use the bundled PCRE.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:69109 advisory.

    Rust is a systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread     safety.  This package includes the Rust compiler and documentation generator.

    Security Fix(es):

    * libgit2: libgit2: Denial of Service due to heap out-of-bounds read from malicious Git server     (CVE-2026-53587)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67286 advisory.

    Rust is a systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread     safety.  This package includes the Rust compiler and documentation generator.

    Security Fix(es):

    * libgit2: libgit2: Denial of Service due to heap out-of-bounds read from malicious Git server     (CVE-2026-53587)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67285 advisory.

    * libgit2: libgit2: Denial of Service due to heap out-of-bounds read from malicious Git server     (CVE-2026-53587)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-61dffcfbe9 advisory.

    - Update libgit2 to version 1.9.6.
    - Update the libgit2-sys Rust crate to the corresponding version 0.18.7.

    This includes fixes for various security issues, including - but not limited to:

    - [CVE-2026-53583](https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp)
    - [CVE-2026-53584](https://github.com/libgit2/libgit2/security/advisories/GHSA-cw77-j82w-mchm)
    - [CVE-2026-53585](https://github.com/libgit2/libgit2/security/advisories/GHSA-27m5-gxxh-x79j)
    - [CVE-2026-53586](https://github.com/libgit2/libgit2/security/advisories/GHSA-2889-x8f6-mc4x)
    - [CVE-2026-53587](https://github.com/libgit2/libgit2/security/advisories/GHSA-pm24-4jhq-3xvm)

    The Fedora package is not affected by [GHSA-     wfx7-g85r-q6vw](https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp) since Fedora     packages always linked the system PCRE2 and did not use the bundled PCRE.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3116 advisory.

    Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from     Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations.



    Uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by Amazon smithy-rs code     generation could allow remote attackers to cause a denial of service (process abort via stack exhaustion)     via a small request containing deeply nested data for a recursive model shape to a generated SDK or     server.



    To mitigate this issue, users should upgrade to aws-sdk-rust release-2026-06-02 or later. Users building     custom servers with smithy-rs codegen should regenerate from smithy-rs release-2026-06-01 or later.
    (CVE-2026-15957)

    libgit2 version 1.9.4 and below is vulnerable to a heap out-of-bounds read in set_data() in     src/libgit2/transports/smart_pkt.c.

    The vulnerable code uses a fixed-size strncmp (smart_pkt.c:239) against the unvalidated capability buffer     of a smart-protocol pkt-line. When the bytes following the pkt-line in the contiguous receive buffer     happen to continue with ct-format=, the comparison spuriously matches, advancing format_str past the     pkt-line boundary. The following memchr(format_str, ' ', len - (format_str - line)) (smart_pkt.c:246) then     underflows its size_t size argument to ~SIZE_MAX and walks the heap looking for a space byte. An     unauthenticated remote attacker who controls (or man-in-the-middles) a Git server reached over     HTTP/HTTPS/SSH/git:// can trigger this on the FIRST ref-pkt of the refs advertisement, before any     capability negotiation has taken place. The OOB walk causes a process crash (SIGSEGV) when memchr enters     an unmapped page, and -- on heap layouts where memchr finds a stray space byte before crashing -- can     additionally drive the git_error_set(...'%.*s', format_len, format_str) formatter to copy a large window     of heap memory into the error string. (CVE-2026-53587)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
354423	Rocky Linux 10.2 [CIQ] Security Update: cargo / cargo-debuginfo / clippy / clippy-debuginfo / rust / etc (crlsa-2026_67286)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
360729	Rocky Linux 9.6 [TuxCare] Security Update: cargo / clippy / rust / rust-analyzer / rust-debugger-common / etc (ALMALINUX9.6:CLSA-2026:1790157025)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
329273	Fedora 45 : libgit2_1.9 / rust-libgit2-sys (2026-7c3fc14617)	Nessus	Fedora Local Security Checks	2026/7/23	2026/8/24	medium
348393	RHEL 9 : rust (RHSA-2026:69109)	Nessus	Red Hat Local Security Checks	2026/9/21	2026/9/21	high
345712	RHEL 10 : rust (RHSA-2026:67286)	Nessus	Red Hat Local Security Checks	2026/9/14	2026/9/14	high
345942	AlmaLinux 9 : rust (ALSA-2026:67285)	Nessus	Alma Linux Local Security Checks	2026/9/15	2026/9/15	high
331601	Fedora 43 : libgit2 / rust-libgit2-sys (2026-61dffcfbe9)	Nessus	Fedora Local Security Checks	2026/8/2	2026/8/24	medium
351074	Amazon Linux 2023 : network-flow-monitor-agent (ALAS2023-2026-3116)	Nessus	Amazon Linux Local Security Checks	2026/9/29	2026/10/25	high

検出

プラグインの検索

high

high

medium

high

high

high

medium

high