The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_22120 advisory.

    * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)

    * cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious     module proxy (CVE-2026-42501)

    * html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag     content (CVE-2026-39823)

    * cmd/go: golang: Go 'go bug' command: Arbitrary file overwrite via symlink attack (CVE-2026-39819)

    * net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed     SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814)

    * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)

    * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

    * net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially     bypassing security controls (CVE-2026-39825)

    * cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction (CVE-2026-39817)

    * html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping     (CVE-2026-39826)

    * net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows     (CVE-2026-39836)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21254-1 advisory.

    Update to go1.26.4  (bsc#1255111).

    Security issues fixed:

    - CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG (bsc#1261653).
    - CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination (bsc#1261654).
    - CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking (bsc#1261655).
    - CVE-2026-27145: crypto/x509: split candidate hostname only once (bsc#1267450).
    - CVE-2026-32280: crypto/x509: unexpected work during chain building (bsc#1261656).
    - CVE-2026-32281: crypto/x509: inefficient policy validation (bsc#1261657).
    - CVE-2026-32282: os: `Root.Chmod` can follow symlinks out of the root on Linux (bsc#1261658).
    - CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock     (bsc#1261659).
    - CVE-2026-32288: archive/tar: unbounded allocation when parsing old format GNU sparse map (bsc#1261660).
    - CVE-2026-32289: html/template: JS template literal context incorrectly tracked (bsc#1261661).
    - CVE-2026-33810: crypto/x509: excluded DNS constraints not properly applied to wildcard domains     (bsc#1261662).
    - CVE-2026-33811: net: crash when handling long `CNAME` response (bsc#1264508).
    - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad `SETTINGS_MAX_FRAME_SIZE`     (bsc#1264506).
    - CVE-2026-39817: cmd/go: `go tool pack` does not sanitize output paths (bsc#1264505).
    - CVE-2026-39819: cmd/go: `go bug` follows symlinks in predictable temporary filenames (bsc#1264504).
    - CVE-2026-39820: net/mail: quadratic string concatentation in `consumeComment` (bsc#1264503).
    - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
    - CVE-2026-39825: net/http/httputil: `ReverseProxy` forwards queries with more than `urlmaxqueryparams`     parameters       (bsc#1264500).
    - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
    - CVE-2026-39836: net: panic in `Dial` and `LookupPort` when handling `NUL` byte on Windows (bsc#1264501).
    - CVE-2026-42499: net/mail: quadratic string concatenation in `consumePhrase` (bsc#1264502).
    - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).
    - CVE-2026-42504: mime: quadratic complexity in `WordDecoder.DecodeHeader` (bsc#1267442).
    - CVE-2026-42507: net/textproto: arbitrary input is included in errors without any escaping (bsc#1267444).

    Other updates and security fixes:

    - Go packages miss `binutils-gold` dependency (bsc#1170826).
    - Drop subpackage `go1.x-libstd` `std` library `.so` refs (jsc#PED-1962).
    - Use `libalternatives` only on `suse_version >= 1610` and keep `update-alternatives` support for older       distributions.
    - Drop the `update-alternatives` migration path for `libalternatives` builds.
    - Enable `libalternatives` for SLE16.1 and Tumbleweed (bsc#1245878).
    - Drop go1.26 dependency on `update-alternatives` (bsc#1264395)
    - Update to version 1.26.3 cut from the `go1.25-fips-release` branch at the revision tagged     `go1.26.3-1-openssl-fips`       (jsc#SLE-18320).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21319-1 advisory.

    This update for go1.25-openssl fixes the following issues

    - Update to version go1.25.12 (bsc#1244485).
    - CVE-2025-61732: cmd/cgo: discrepancy between Go and C/C++ comment parsing allows for C code smuggling     (bsc#1257692).
    - CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session ticket keys, session     resumption does not account for the expiration of full certificate chain (bsc#1256818).
    - CVE-2026-25679: net/url: reject IPv6 literal not at start of host (bsc#1259264).
    - CVE-2026-27139: os: FileInfo can escape from a Root (bsc#1259268).
    - CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG (bsc#1261653).
    - CVE-2026-27142: html/template: URLs in meta content attribute actions are not escaped (bsc#1259265).
    - CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination (bsc#1261654).
    - CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking (bsc#1261655).
    - CVE-2026-27145: crypto/x509: split candidate hostname only once (bsc#1267450).
    - CVE-2026-32280: crypto/x509: unexpected work during chain building (bsc#1261656).
    - CVE-2026-32281: crypto/x509: inefficient policy validation (bsc#1261657).
    - CVE-2026-32282: os: Root.Chmod can follow symlinks out of the root on Linux (bsc#1261658).
    - CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock     (bsc#1261659).
    - CVE-2026-32288: archive/tar: unbounded allocation when parsing old format GNU sparse map (bsc#1261660).
    - CVE-2026-32289: html/template: JS template literal context incorrectly tracked (bsc#1261661).
    - CVE-2026-33811: net: crash when handling long CNAME response (bsc#1264508).
    - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE     (bsc#1264506).
    - CVE-2026-39817: cmd/go: go tool pack does not sanitize output paths (bsc#1264505).
    - CVE-2026-39819: cmd/go: go bug follows symlinks in predictable temporary filenames (bsc#1264504).
    - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment (bsc#1264503).
    - CVE-2026-39822: os: Root escape via symlink plus trailing slash (bsc#1271014).
    - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
    - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams     parameters (bsc#1264500).
    - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
    - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows (bsc#1264501).
    - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase (bsc#1264502).
    - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).
    - CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader (bsc#1267442).
    - CVE-2026-42505: crypto/tls: omit PSK in ECH outer client hello (bsc#1271015).
    - CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping     (bsc#1267444).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22638-1 advisory.

    This update for go1.25-openssl fixes the following issues

    - Update to version go1.25.12 (bsc#1244485).
    - CVE-2025-61732: cmd/cgo: discrepancy between Go and C/C++ comment parsing allows for C code smuggling     (bsc#1257692).
    - CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session ticket keys, session     resumption does not account for the expiration of full certificate chain (bsc#1256818).
    - CVE-2026-25679: net/url: reject IPv6 literal not at start of host (bsc#1259264).
    - CVE-2026-27139: os: FileInfo can escape from a Root (bsc#1259268).
    - CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG (bsc#1261653).
    - CVE-2026-27142: html/template: URLs in meta content attribute actions are not escaped (bsc#1259265).
    - CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination (bsc#1261654).
    - CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking (bsc#1261655).
    - CVE-2026-27145: crypto/x509: split candidate hostname only once (bsc#1267450).
    - CVE-2026-32280: crypto/x509: unexpected work during chain building (bsc#1261656).
    - CVE-2026-32281: crypto/x509: inefficient policy validation (bsc#1261657).
    - CVE-2026-32282: os: Root.Chmod can follow symlinks out of the root on Linux (bsc#1261658).
    - CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock     (bsc#1261659).
    - CVE-2026-32288: archive/tar: unbounded allocation when parsing old format GNU sparse map (bsc#1261660).
    - CVE-2026-32289: html/template: JS template literal context incorrectly tracked (bsc#1261661).
    - CVE-2026-33811: net: crash when handling long CNAME response (bsc#1264508).
    - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE     (bsc#1264506).
    - CVE-2026-39817: cmd/go: go tool pack does not sanitize output paths (bsc#1264505).
    - CVE-2026-39819: cmd/go: go bug follows symlinks in predictable temporary filenames (bsc#1264504).
    - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment (bsc#1264503).
    - CVE-2026-39822: os: Root escape via symlink plus trailing slash (bsc#1271014).
    - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
    - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams     parameters (bsc#1264500).
    - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
    - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows (bsc#1264501).
    - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase (bsc#1264502).
    - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).
    - CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader (bsc#1267442).
    - CVE-2026-42505: crypto/tls: omit PSK in ECH outer client hello (bsc#1271015).
    - CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping     (bsc#1267444).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
356989	Rocky Linux 10.2 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (crlsa-2026_22120)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium
326021	openSUSE 16 Security Update : go1.26-openssl (openSUSE-SU-2026:21254-1)	Nessus	SuSE Local Security Checks	2026/7/9	2026/7/9	critical
327238	openSUSE 16 Security Update : go1.25-openssl (openSUSE-SU-2026:21319-1)	Nessus	SuSE Local Security Checks	2026/7/16	2026/7/27	critical
327569	SUSE SLES16 Security Update : go1.25-openssl (SUSE-SU-2026:22638-1)	Nessus	SuSE Local Security Checks	2026/7/17	2026/7/27	critical

检测

插件搜索

medium

critical

critical

critical