It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1671 advisory.

    SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early     termination of the client process. (CVE-2025-47913)

    Arithmetic over induction variables in loops were not correctly checked for underflow or overflow in the     Go compiler (cmd/compile). As a result, the compiler would allow for invalid indexing to occur at runtime,     potentially leading to memory corruption in programs compiled with affected Go versions. (CVE-2026-27143)

    The Go compiler (cmd/compile) incorrectly handled no-op interface conversions, preventing correct     determination about non-overlapping memory moves, potentially leading to memory corruption at runtime in     programs compiled with affected Go versions. (CVE-2026-27144)

    During chain building, the amount of work that is done is not correctly limited when a large number of     intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of     service. This affects both direct users of crypto/x509 and users of crypto/tls. (CVE-2026-32280)

    Validating certificate chains which use policies is unexpectedly inefficient when certificates in the     chain contain a very large number of policy mappings, possibly causing denial of service. This only     affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots     CertPool, or in the system certificate pool. (CVE-2026-32281)

    On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress,     Chmod can operate on the target of the symlink, even when the target lies outside the root.
    (CVE-2026-32282)

    If one side of the TLS connection sends multiple key update messages post-handshake in a single record,     the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of     service. This only affects TLS 1.3. (CVE-2026-32283)

    tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive     containing a large number of sparse regions encoded in the old GNU sparse map format. (CVE-2026-32288)

    Context was not properly tracked across template branches for JS template literals, leading to possibly     incorrect escaping of content. This could cause actions within JS template literals to be incorrectly     escaped, leading to XSS vulnerabilities. (CVE-2026-32289)

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and     repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components     may allow access to files outside the checked-out Git repository root. Possible access is limited to files     on the same mounted filesystem. The issue has been fixed in version v0.28.1 The issue affects only builds     that use Git URLs with a subpath component. As a workaround, avoid building Dockerfiles from untrusted     sources or using the subdir component from an untrusted Git repository where the subdir component could     point to a symlink. (CVE-2026-33748)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS     if the meta tag also has an http-equiv attribute with the value 'refresh'. A new GODEBUG setting has been     added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content     attribute which follow 'url=' by setting htmlmetacontenturlescape=0.(CVE-2026-27142)

    SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code     execution at build time due to trust layer bypass.(CVE-2026-27140)

    tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive     containing a large number of sparse regions encoded in the 'old GNU sparse map' format.(CVE-2026-32288)

Tenable has extracted the preceding description block directly from the EulerOS golang security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive     containing a large number of sparse regions encoded in the 'old GNU sparse map' format.(CVE-2026-32288)

    SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code     execution at build time due to trust layer bypass.(CVE-2026-27140)

Tenable has extracted the preceding description block directly from the EulerOS golang security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1581-1 advisory.

    - Update to go1.25.9 (bsc#1244485).
    - CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG (bsc#1261653).
    - CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination (bsc#1261654).
    - CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking (bsc#1261655).
    - CVE-2026-32280: crypto/x509: unexpected work during chain building (bsc#1261656).
    - CVE-2026-32281: crypto/x509: inefficient policy validation (bsc#1261657).
    - CVE-2026-32282: os: Root.Chmod can follow symlinks out of the root on Linux (bsc#1261658).
    - CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock     (bsc#1261659).
    - CVE-2026-32288: archive/tar: unbounded allocation when parsing old format GNU sparse map (bsc#1261660).
    - CVE-2026-32289: html/template: JS template literal context incorrectly tracked (bsc#1261661).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of golang installed on the remote host is prior to 1.25.9-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3259 advisory.

    SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code     execution at build time in the Go toolchain (cmd/go) due to trust layer bypass. (CVE-2026-27140)

    Arithmetic over induction variables in loops were not correctly checked for underflow or overflow in the     Go compiler (cmd/compile). As a result, the compiler would allow for invalid indexing to occur at runtime,     potentially leading to memory corruption in programs compiled with affected Go versions. (CVE-2026-27143)

    The Go compiler (cmd/compile) incorrectly handled no-op interface conversions, preventing correct     determination about non-overlapping memory moves, potentially leading to memory corruption at runtime in     programs compiled with affected Go versions. (CVE-2026-27144)

    During chain building, the amount of work that is done is not correctly limited when a large number of     intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of     service. This affects both direct users of crypto/x509 and users of crypto/tls. (CVE-2026-32280)

    Validating certificate chains which use policies is unexpectedly inefficient when certificates in the     chain contain a very large number of policy mappings, possibly causing denial of service. This only     affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots     CertPool, or in the system certificate pool. (CVE-2026-32281)

    On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress,     Chmod can operate on the target of the symlink, even when the target lies outside the root.
    (CVE-2026-32282)

    If one side of the TLS connection sends multiple key update messages post-handshake in a single record,     the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of     service. This only affects TLS 1.3. (CVE-2026-32283)

    tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive     containing a large number of sparse regions encoded in the old GNU sparse map format. (CVE-2026-32288)

    Context was not properly tracked across template branches for JS template literals, leading to possibly     incorrect escaping of content. This could cause actions within JS template literals to be incorrectly     escaped, leading to XSS vulnerabilities. (CVE-2026-32289)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1599 advisory.

    Arithmetic over induction variables in loops were not correctly checked for underflow or overflow in the     Go compiler (cmd/compile). As a result, the compiler would allow for invalid indexing to occur at runtime,     potentially leading to memory corruption in programs compiled with affected Go versions. (CVE-2026-27143)

    The Go compiler (cmd/compile) incorrectly handled no-op interface conversions, preventing correct     determination about non-overlapping memory moves, potentially leading to memory corruption at runtime in     programs compiled with affected Go versions. (CVE-2026-27144)

    During chain building, the amount of work that is done is not correctly limited when a large number of     intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of     service. This affects both direct users of crypto/x509 and users of crypto/tls. (CVE-2026-32280)

    Validating certificate chains which use policies is unexpectedly inefficient when certificates in the     chain contain a very large number of policy mappings, possibly causing denial of service. This only     affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots     CertPool, or in the system certificate pool. (CVE-2026-32281)

    On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress,     Chmod can operate on the target of the symlink, even when the target lies outside the root.
    (CVE-2026-32282)

    If one side of the TLS connection sends multiple key update messages post-handshake in a single record,     the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of     service. This only affects TLS 1.3. (CVE-2026-32283)

    tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive     containing a large number of sparse regions encoded in the old GNU sparse map format. (CVE-2026-32288)

    Context was not properly tracked across template branches for JS template literals, leading to possibly     incorrect escaping of content. This could cause actions within JS template literals to be incorrectly     escaped, leading to XSS vulnerabilities. (CVE-2026-32289)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
315638	Amazon Linux 2023 : runfinch-finch (ALAS2023-2026-1671)	Nessus	Amazon Linux Local Security Checks	2026/5/20	2026/5/20	high
326130	EulerOS 2.0 SP12 : golang (EulerOS-SA-2026-2531)	Nessus	Huawei Local Security Checks	2026/7/10	2026/7/10	high
333453	EulerOS 2.0 SP11 : golang (EulerOS-SA-2026-3068)	Nessus	Huawei Local Security Checks	2026/8/8	2026/8/8	high
310227	SUSE SLES15 Security Update : go1.25-openssl (SUSE-SU-2026:1581-1)	Nessus	SuSE Local Security Checks	2026/4/25	2026/4/25	critical
311200	Amazon Linux 2 : golang, --advisory ALAS2-2026-3259 (ALAS-2026-3259)	Nessus	Amazon Linux Local Security Checks	2026/4/30	2026/4/30	critical
311313	Amazon Linux 2023 : golist (ALAS2023-2026-1599)	Nessus	Amazon Linux Local Security Checks	2026/4/30	2026/4/30	critical

检测

插件搜索

high

high

high

critical

critical

critical