The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:65153 advisory.

    * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)

    * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)

    * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect     Punycode label processing (CVE-2026-39821)

    * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)

    * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal     (CVE-2026-33818)

    * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)

    * net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service     (CVE-2026-56853)

    * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

    * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages     (CVE-2026-56862)

    * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:66016 advisory.

    * golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)
      * golang: net/[http:](http:) net/[http:](http:) sensitive headers incorrectly sent after cross-domain     redirect (CVE-2024-45336)
      * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)
      * golang.org/x/net/idna: golang: net/[http:](http:) golang.org/x/net/idna: Privilege escalation via     incorrect Punycode label processing (CVE-2026-39821)
      * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal     (CVE-2026-33818)
      * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)
      * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial     of Service (CVE-2026-56853)
      * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
      * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages     (CVE-2026-56862)
      * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-651530 advisory.

    [175-1.0.2]
    - Rebuild to fix CVE-2026-33818, CVE-2026-39820, CVE-2026-39821, CVE-2026-42499,       CVE-2026-42504, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860,       CVE-2026-56862

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:68527 advisory.

    Collector with the supported components for a Red Hat build of OpenTelemetry

    Security Fix(es):

    * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)

    * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)

    * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)

    * github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage:
    go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers     (CVE-2026-41178)

    * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal     (CVE-2026-33818)

    * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)

    * net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service     (CVE-2026-56853)

    * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

    * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages     (CVE-2026-56862)

    * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788942909 advisory.

  - Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive     structures. (CVE-2026-33818)

  - Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive     CPU exhaustion and memory allocations. (CVE-2026-39820)

  - Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC     5322. (CVE-2026-42499)

  - When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection     to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when     doing this. (CVE-2026-56853)

  - Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to     inject arbitrary content, potentially leading to XSS. (CVE-2026-56858)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789469873 advisory.

  - Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive     structures. (CVE-2026-33818)

  - Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive     CPU exhaustion and memory allocations. (CVE-2026-39820)

  - Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC     5322. (CVE-2026-42499)

  - When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection     to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when     doing this. (CVE-2026-56853)

  - Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to     inject arbitrary content, potentially leading to XSS. (CVE-2026-56858)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_65116 advisory.

    * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)

    * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)

    * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)

    * github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage:
    go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers     (CVE-2026-41178)

    * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal     (CVE-2026-33818)

    * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)

    * net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service     (CVE-2026-56853)

    * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

    * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages     (CVE-2026-56862)

    * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781178389 advisory.

  - Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive     CPU exhaustion and memory allocations. (CVE-2026-39820)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:76795 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

    * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint     application (CVE-2026-33810)

    * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)

    * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)

    * grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)

    * grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default     (CVE-2026-33376)

    * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect     Punycode label processing (CVE-2026-39821)

    * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)

    * grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads     (CVE-2026-42127)

    * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal     (CVE-2026-33818)

    * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)

    * net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service     (CVE-2026-56853)

    * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

    * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages     (CVE-2026-56862)

    * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive     CPU exhaustion and memory allocations. (CVE-2026-39820)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
344414	RockyLinux 9 : osbuild-composer (RLSA-2026:65153)	Nessus	Rocky Linux Local Security Checks	2026/9/9	2026/9/9	high
344515	AlmaLinux 8 : osbuild-composer (ALSA-2026:66016)	Nessus	Alma Linux Local Security Checks	2026/9/10	2026/9/10	high
344855	Oracle Linux 9 : ELSA-2026-65153-0: / osbuild-composer (ELSA-2026-651530)	Nessus	Oracle Linux Local Security Checks	2026/9/11	2026/9/11	high
346927	RHEL 9 : opentelemetry-collector (RHSA-2026:68527)	Nessus	Red Hat Local Security Checks	2026/9/17	2026/9/17	high
351565	AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1788942909)	Nessus	Alma Linux Local Security Checks	2026/9/30	2026/9/30	high
351783	Rocky Linux 9.6 [TuxCare] Security Update: ignition / ignition-edge / ignition-grub / ignition-validate Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789469873)	Nessus	Rocky Linux Local Security Checks	2026/9/30	2026/9/30	high
353914	Rocky Linux 10.2 [CIQ] Security Update: opentelemetry-collector Multiple Vulnerabilities (crlsa-2026_65116)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
360426	AlmaLinux 9.6 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (ALMALINUX9.6:CLSA-2026:1781178389)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/1	high
363382	RHEL 9 : grafana (RHSA-2026:76795)	Nessus	Red Hat Local Security Checks	2026/10/6	2026/10/8	high
313258	Linux Distros Unpatched Vulnerability : CVE-2026-39820	Nessus	Misc.	2026/5/8	2026/9/9	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high