The version of Golang running on the remote host is 1.25.x prior to 1.25.13, or 1.26.x prior to 1.26.6. It is, therefore, affected by multiple vulnerabilities in the standard library and the toolchain, as referenced in the golang-announce advisory.

  - The ToASCII and ToUnicode functions incorrectly accepted Punycode-encoded labels that decode to an     ASCII-only label. This can lead to privilege escalation in programs using the idna package.
    (CVE-2026-39821)

  - When a server is configured to support unencrypted HTTP/2, it reads bytes from each new connection     to check for the HTTP/2 client preface. Previously this was done with no timeout. ReadHeaderTimeout     is now applied for this check. (CVE-2026-56853)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:63332 advisory.

    The buildah package provides a tool for facilitating building OCI container images. Among other things,     buildah enables you to: Create a working container, either from scratch or using an image as a starting     point; Create an image, either from a working container or using the instructions in a Dockerfile; Build     both Docker and OCI images.

    Security Fix(es):

    * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint     application (CVE-2026-33810)

    * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)

    * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal     (CVE-2026-33818)

    * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)

    * net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service     (CVE-2026-56853)

    * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

    * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages     (CVE-2026-56862)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:62406 advisory.

    * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)
      * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)
      * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal     (CVE-2026-33818)
      * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)
      * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial     of Service (CVE-2026-56853)
      * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
      * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages     (CVE-2026-56862)
      * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:63130 advisory.

    rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and     subscription management.

    Security Fix(es):

    * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal     (CVE-2026-33818)

    * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)

    * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

    * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages     (CVE-2026-56862)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:63163 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)

    * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal     (CVE-2026-33818)

    * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)

    * net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service     (CVE-2026-56853)

    * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

    * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages     (CVE-2026-56862)

    * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:63022 advisory.

    * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)

    * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)

    * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal     (CVE-2026-33818)

    * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)

    * net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service     (CVE-2026-56853)

    * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

    * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages     (CVE-2026-56862)

    * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
335411	Golang 1.25.x < 1.25.13 / 1.26.x < 1.26.6 Multiple Vulnerabilities	Nessus	Misc.	2026/8/14	2026/8/28	high
342746	RHEL 10 : buildah (RHSA-2026:63332)	Nessus	Red Hat Local Security Checks	2026/9/4	2026/9/4	high
342838	AlmaLinux 9 : grafana (ALSA-2026:62406)	Nessus	Alma Linux Local Security Checks	2026/9/4	2026/9/4	high
342667	RHEL 9 : rhc (RHSA-2026:63130)	Nessus	Red Hat Local Security Checks	2026/9/3	2026/9/3	medium
342744	RHEL 8 : container-tools:rhel8 (RHSA-2026:63163)	Nessus	Red Hat Local Security Checks	2026/9/4	2026/9/4	medium
342835	RockyLinux 10 : grafana (RLSA-2026:63022)	Nessus	Rocky Linux Local Security Checks	2026/9/4	2026/9/4	high

检测

插件搜索

high

high

high

medium

medium

high