http://example.com/node/111 also accessible through http://example.com/node/111.000
Automated scans sometimes report issues that are non-issues, and the results of an automated scan do need to be combined with an understanding of the issues at hand (and, if they require fixing, the risks of introducing new code to mitigate supposed vulnerabilities).

As R. Leurquin says, in Drupal there are multiple URLs that may work to access the same node or path directly. While this might not be ideal for SEO (if people link to multiple URLs), it likely isn't an actual security concern.

This can likely be solved using approaches like the Global Redirect module in Drupal 7, and the Redirect module in Drupal 8 (and in D7 if patched from #905914: Merge global redirect functions into Redirect module).

You'll get the SEO improvements, and if the security team really need convincing, hopefully it's an easy item to knock off the list!

If those don't cut it, you could do something similar to what Global Redirect or Redirect do, eg implement hook_url_inbound_alter() or hook_init(), check for those zeroes, and redirect them. In that case, be careful that the "fix" for this "problem" is not riskier than the existing situation.

You could also handle this with redirects at the webserver layer.