The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1411 advisory.

    This advisory aggregates security fixes for the golang SRPM in CIQ LTS 9.6. It addresses 50 CVEs:
    CVE-2026-27143, CVE-2025-61729, CVE-2019-6486, CVE-2025-22870, CVE-2026-32282, and 45 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0424 advisory.

    This advisory aggregates security fixes for the golang SRPM in CIQ LTS 9.2. It addresses 14 CVEs:
    CVE-2019-6486, CVE-2017-15042, CVE-2024-24791, CVE-2024-34158, CVE-2016-3959, and 9 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The web application running on the remote web server is affected by a man-in-the-middle vulnerability known as 'httpoxy' due to a failure to properly resolve namespace conflicts in accordance with RFC 3875 section 4.1.18. The HTTP_PROXY environment variable is set based on untrusted user data in the 'Proxy' header of HTTP requests. The HTTP_PROXY environment variable is used by some web client libraries to specify a remote proxy server. An unauthenticated, remote attacker can exploit this, via a crafted 'Proxy' header in an HTTP request, to redirect an application's internal HTTP traffic to an arbitrary proxy server where it may be observed or manipulated.

Security fix for CVE-2016-5386 AKA https://httpoxy.org/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-1538 advisory.

    - Resolves: rhbz#1358278 - CVE-2016-5386

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for golang is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The golang packages provide the Go programming language compiler.

The following packages have been upgraded to a newer upstream version:
golang (1.6.3). (BZ#1346331)

Security Fix(es) :

* An input-validation flaw was discovered in the Go programming language built in CGI implementation, which set the environment variable 'HTTP_PROXY' using the incoming 'Proxy' HTTP-request header.
The environment variable 'HTTP_PROXY' is used by numerous web clients, including Go's net/http package, to specify a proxy server to use for HTTP and, in some cases, HTTPS requests. This meant that when a CGI-based web application ran, an attacker could specify a proxy server which the application then used for subsequent outgoing requests, allowing a man-in-the-middle attack. (CVE-2016-5386)

Red Hat would like to thank Scott Geary (VendHQ) for reporting this issue.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace     conflicts and therefore does not protect CGI applications from the presence of untrusted client data in     the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's     outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an     httpoxy issue. (CVE-2016-5386)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
355405	Rocky Linux 9.6 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (ciqsa-2026_1411)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	critical
355413	Rocky Linux 9.2 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (ciqsa-2026_0424)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	critical
92539	HTTP_PROXY Environment Variable Namespace Collision Vulnerability (httpoxy)	Nessus	Web Servers	2016/7/25	2026/1/30	high
92615	Fedora 23 : golang (2016-340e361b90) (httpoxy)	Nessus	Fedora Local Security Checks	2016/7/29	2026/1/30	high
92622	Fedora 24 : golang (2016-ea5e284d34) (httpoxy)	Nessus	Fedora Local Security Checks	2016/7/29	2026/1/30	high
92687	Oracle Linux 7 : golang (ELSA-2016-1538)	Nessus	Oracle Linux Local Security Checks	2016/8/3	2024/10/22	high
92680	CentOS 7 : golang (CESA-2016:1538) (httpoxy)	Nessus	CentOS Local Security Checks	2016/8/3	2026/1/29	critical
261016	Linux Distros Unpatched Vulnerability : CVE-2016-5386	Nessus	Misc.	2025/9/3	2026/11/5	high

检测

插件搜索

critical

critical

high

high

high

high

critical

high