http://example.com/node/111 also accessible through http://example.com/node/111.000 An acunetix scan has complained about the following:

http://example.com/node/111.000 or http://example.com/node/111.0 or http://example.com/node/111.000000 (any number of zeros) serves the node http://example.com/node/111  

For the regular url, the pathalias is then used, for the url with .0 added, it is displayed as is. 

Two questions: is it possible to disable this behavior, and if not, is there a standard reference to justify this to our security team?
Automated scans sometimes report issues that are non-issues, and the results of an automated scan do need to be combined with an understanding of the issues at hand (and, if they require fixing, the risks of introducing new code to mitigate supposed vulnerabilities).

As R. Leurquin says, in Drupal there are multiple URLs that may work to access the same node or path directly. While this might not be ideal for SEO (if people link to multiple URLs), it likely isn't an actual security concern.

This can likely be solved using approaches like the Global Redirect module in Drupal 7, and the Redirect module in Drupal 8 (and in D7 if patched from #905914: Merge global redirect functions into Redirect module).

You'll get the SEO improvements, and if the security team really need convincing, hopefully it's an easy item to knock off the list!

If those don't cut it, you could do something similar to what Global Redirect or Redirect do, eg implement hook_url_inbound_alter() or hook_init(), check for those zeroes, and redirect them. In that case, be careful that the "fix" for this "problem" is not riskier than the existing situation.

You could also handle this with redirects at the webserver layer.