The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1861-1 advisory.

    This update for go1.26 fixes the following issues

    Security issues:

    - CVE-2026-33811: net: crash when handling long CNAME response (bsc#1264508).
    - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE     (bsc#1264506).
    - CVE-2026-39817: cmd/go: 'go tool pack' does not sanitize output paths (bsc#1264505).
    - CVE-2026-39819: cmd/go: 'go bug' follows symlinks in predictable temporary filenames (bsc#1264504).
    - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment (bsc#1264503).
    - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
    - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams     parameters       (bsc#1264500).
    - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
    - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows (bsc#1264501).
    - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase (bsc#1264502).
    - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).

    Non security issues:

    - go1.26 release tracking (bsc#1255111).
    - Go packages miss binutils-gold dependency (bsc#1170826).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC     5322.(CVE-2026-42499)

    If a trusted template author were to write a script tag containing an empty 'type' attribute or a     'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data     passed into the script block.(CVE-2026-39826)

    When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION     frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.(CVE-2026-33814)

    ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a     Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the     forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not     take ParseQuery's limit on the total number of query parameters (controlled by     GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a     query parameter that is not visible to the Rewrite function. For example, the query     'a1=xa2=x...a10000=xhidden=y' can forward the parameter 'hidden=y' while hiding it from the     proxy's Rewrite function.(CVE-2026-39825)

    A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting     cgo binary.(CVE-2025-61732)

    The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL     (0).(CVE-2026-39836)

    The 'go bug' command writes to two files with predictable names in the system temporary directory (for     example, '/tmp'). An attacker with access to the temporary directory can create a symlink in one of these     names, causing 'go bug' to overwrite the target of the symlink.(CVE-2026-39819)

    A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass     checksum database validation. This vulnerability affects any user using an untrusted module proxy     (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can serve altered versions of the Go     toolchain. When selecting a different version of the Go toolchain than the currently installed toolchain     (due to the GOTOOLCHAIN environment variable, or a go.work or go.mod with a toolchain line), the go     command will download and execute a toolchain provided by the module proxy. A malicious module proxy can     bypass checksum database validation for this downloaded toolchain. Since this vulnerability affects the     security of toolchain downloads, setting GOTOOLCHAIN to a fixed version is not sufficient. You must     upgrade your base Go toolchain. The go tool always validates the hash of a toolchain before executing it,     so fixed versions will refuse to execute any cached, altered versions of the toolchain. The go tool trusts     go.sum files to contain accurate hashes of the current module's dependencies. A malicious proxy exploiting     this vulnerability to serve an altered module will have caused an incorrect hash to be recorded in the     go.sum. Users who have configured a non-trusted GOPROXY can determine if they have been affected by     running 'rm go.sum ; go mod tidy ; go mod verify', which will revalidate all dependencies of the current     module. The specific flaw in more detail: The go command consults the checksum database to validate     downloaded modules, when a module is not listed in the go.sum file. It verifies that the module hash     reported by the checksum database matches the hash of the downloaded module. If, however, the checksum     database returns a successful response that contains no entry for the module, the go command incorrectly     permitted validation to succeed. A module proxy may mirror or proxy the checksum database, in which case     the go command will not connect to the checksum database directly. Checksums reported by the checksum     database are cryptographically signed, so a malicious proxy cannot alter the reported checksum for a     module. However, a proxy which returns an empty checksum response, or a checksum response for an unrelated     module, could cause the go command to proceed as if a downloaded module has been     validated.(CVE-2026-42501)

    Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive     CPU exhaustion and memory allocations.(CVE-2026-39820)

    When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of     C memory and a crash.(CVE-2026-33811)

    The 'go tool pack' subcommand (usually used only by the compiler as an internal tool with known-good     inputs) does not sanitize output filenames. Extracting a malicious archive file with the 'pack' subcommand     can write files to arbitrary locations on the filesystem.(CVE-2026-39817)

    CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a meta tag's     content attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of     the content attribute, the escaper would fail to similarly escape it, leading to     XSS.(CVE-2026-39823)

    If one side of the TLS connection sends multiple key update messages post-handshake in a single record,     the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of     service. This only affects TLS 1.3.(CVE-2026-32283)

    During chain building, the amount of work that is done is not correctly limited when a large number of     intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of     service. This affects both direct users of crypto/x509 and users of crypto/tls.(CVE-2026-32280)

    The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface     conversion prevented the compiler from making the correct determination about non-overlapping moves,     potentially leading to memory corruption at runtime.(CVE-2026-27144)

    SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code     execution at build time due to trust layer bypass.(CVE-2026-27140)

    tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive     containing a large number of sparse regions encoded in the 'old GNU sparse map' format.(CVE-2026-32288)

Tenable has extracted the preceding description block directly from the EulerOS golang security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1743 advisory.

    When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of     C memory and a crash. (CVE-2026-33811)

    When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION     frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. (CVE-2026-33814)

    The go tool pack subcommand (usually used only by the compiler as an internal tool with known-good     inputs) does not sanitize output filenames. Extracting a malicious archive file with the pack subcommand     can write files to arbitrary locations on the filesystem. (CVE-2026-39817)

    The go bug command writes to two files with predictable names in the system temporary directory (for     example, /tmp). An attacker with access to the temporary directory can create a symlink in one of these     names, causing go bug to overwrite the target of the symlink. (CVE-2026-39819)

    Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive     CPU exhaustion and memory allocations. (CVE-2026-39820)

    CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's     <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the     <content> attribute, the escaper would fail to similarly escape it, leading to XSS. (CVE-2026-39823)

    ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a     Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the     forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not     take ParseQuery's limit on the total number of query parameters (controlled by     GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a     query parameter that is not visible to the Rewrite function. For example, the query     a1=x&a2=x&...&a10000=x&hidden=y can forward the parameter hidden=y while hiding it from the proxy's     Rewrite function. (CVE-2026-39825)

    If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type'     attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed     into the <script> block. (CVE-2026-39826)

    Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC     5322. (CVE-2026-42499)

    A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass     checksum database validation. This vulnerability affects any user using an untrusted module proxy     (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can serve altered versions of the Go     toolchain. When selecting a different version of the Go toolchain than the currently installed toolchain     (due to the GOTOOLCHAIN environment variable, or a go.work or go.mod with a toolchain line), the go     command will download and execute a toolchain provided by the module proxy. A malicious module proxy can     bypass checksum database validation for this downloaded toolchain. Since this vulnerability affects the     security of toolchain downloads, setting GOTOOLCHAIN to a fixed version is not sufficient. You must     upgrade your base Go toolchain. The go tool always validates the hash of a toolchain before executing it,     so fixed versions will refuse to execute any cached, altered versions of the toolchain. The go tool trusts     go.sum files to contain accurate hashes of the current module's dependencies. A malicious proxy exploiting     this vulnerability to serve an altered module will have caused an incorrect hash to be recorded in the     go.sum. Users who have configured a non-trusted GOPROXY can determine if they have been affected by     running rm go.sum ; go mod tidy ; go mod verify, which will revalidate all dependencies of the current     module. The specific flaw in more detail: The go command consults the checksum database to validate     downloaded modules, when a module is not listed in the go.sum file. It verifies that the module hash     reported by the checksum database matches the hash of the downloaded module. If, however, the checksum     database returns a successful response that contains no entry for the module, the go command incorrectly     permitted validation to succeed. A module proxy may mirror or proxy the checksum database, in which case     the go command will not connect to the checksum database directly. Checksums reported by the checksum     database are cryptographically signed, so a malicious proxy cannot alter the reported checksum for a     module. However, a proxy which returns an empty checksum response, or a checksum response for an unrelated     module, could cause the go command to proceed as if a downloaded module has been validated.
    (CVE-2026-42501)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2078-1 advisory.

    This update for go1.26-openssl fixes the following issues

    Security issues:

    - CVE-2026-33811: net: crash when handling long CNAME response (bsc#1264508).
    - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE     (bsc#1264506).
    - CVE-2026-39817: cmd/go: 'go tool pack' does not sanitize output paths (bsc#1264505).
    - CVE-2026-39819: cmd/go: 'go bug' follows symlinks in predictable temporary filenames (bsc#1264504).
    - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment (bsc#1264503).
    - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
    - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams     parameters       (bsc#1264500).
    - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
    - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows (bsc#1264501).
    - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase (bsc#1264502).
    - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).

    Non security issues:

    - go1.26 release tracking (bsc#1255111).
    - Go packages miss binutils-gold dependency (bsc#1170826).
    - supply a go built with openssl linkage (jsc#SLE-18320).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2093-1 advisory.

    This update for go1.25-openssl fixes the following issues

    Security issues:

    - CVE-2026-33811: net: crash when handling long CNAME response (bsc#1264508).
    - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE     (bsc#1264506).
    - CVE-2026-39817: cmd/go: 'go tool pack' does not sanitize output paths (bsc#1264505).
    - CVE-2026-39819: cmd/go: 'go bug' follows symlinks in predictable temporary filenames (bsc#1264504).
    - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment (bsc#1264503).
    - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
    - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams     parameters       (bsc#1264500).
    - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
    - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows (bsc#1264501).
    - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase (bsc#1264502).
    - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).

    Non security issues:

    - go1.25 release tracking (bsc#1244485).
    - Go packages miss binutils-gold dependency (bsc#1170826).
    - supply a go built with openssl linkage (jsc#SLE-18320).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2092-1 advisory.

    This update for go1.26-openssl fixes the following issues

    Security issues:

    - CVE-2026-33811: net: crash when handling long CNAME response (bsc#1264508).
    - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE     (bsc#1264506).
    - CVE-2026-39817: cmd/go: 'go tool pack' does not sanitize output paths (bsc#1264505).
    - CVE-2026-39819: cmd/go: 'go bug' follows symlinks in predictable temporary filenames (bsc#1264504).
    - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment (bsc#1264503).
    - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
    - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams     parameters       (bsc#1264500).
    - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
    - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows (bsc#1264501).
    - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase (bsc#1264502).
    - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).

    Non security issues:

    - go1.26 release tracking (bsc#1255111).
    - Go packages miss binutils-gold dependency (bsc#1170826).
    - supply a go built with openssl linkage (jsc#SLE-18320).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-22112 advisory.

    delve     [1.25.2-1.0.1]     golang     [1.25.9-1.0.1]
    - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var
    - Backported from OL9u7
    - Resolves: OLDIS-53586

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-22121 advisory.

    [1.26.3-1.0.1]
    - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var

    [1.26.3-1]
    - Update to Go 1.26.3 (fips-1)
    - Resolves: RHEL-175607

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
315037	SUSE SLED15 / SLES15 Security Update : go1.26 (SUSE-SU-2026:1861-1)	Nessus	SuSE Local Security Checks	2026/5/16	2026/5/16	medium
332842	EulerOS 2.0 SP13 : golang (EulerOS-SA-2026-3017)	Nessus	Huawei Local Security Checks	2026/8/6	2026/8/6	high
316931	Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2026-1743)	Nessus	Amazon Linux Local Security Checks	2026/5/27	2026/5/27	medium
317661	SUSE SLED15 / SLES15 Security Update : go1.26-openssl (SUSE-SU-2026:2078-1)	Nessus	SuSE Local Security Checks	2026/5/29	2026/5/29	medium
317666	SUSE SLES15 Security Update : go1.25-openssl (SUSE-SU-2026:2093-1)	Nessus	SuSE Local Security Checks	2026/5/29	2026/5/29	medium
317722	SUSE SLES15 Security Update : go1.26-openssl (SUSE-SU-2026:2092-1)	Nessus	SuSE Local Security Checks	2026/5/29	2026/5/29	medium
318661	Oracle Linux 8 : go-toolset:ol8 (ELSA-2026-22112)	Nessus	Oracle Linux Local Security Checks	2026/6/4	2026/6/4	medium
322582	Oracle Linux 9 : golang (ELSA-2026-22121)	Nessus	Oracle Linux Local Security Checks	2026/6/24	2026/6/24	medium

检测

插件搜索

medium

high

medium

medium

medium

medium

medium

medium