go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.3, go-redis potentially responds out of order when `CLIENT SETINFO` times out during connection establishment. This can happen when the client is configured to transmit its identity, there are network connectivity issues, or the client was configured with aggressive timeouts. The problem occurs for multiple use cases. For sticky connections, you receive persistent out-of-order responses for the lifetime of the connection. All commands in the pipeline receive incorrect responses. When used with the default ConnPool once a connection is returned after use with ConnPool#Put the read buffer will be checked and the connection will be marked as bad due to the unread data. This means that at most one out-of-order response before the connection is discarded. This issue is fixed in 9.5.5, 9.6.3, and 9.7.3. You can prevent the vulnerability by setting the flag DisableIndentity to true when constructing the client instance.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20940-1 advisory.

    Changes in grafana:

    - CVE-2026-39821: Fix validation bypass and privilege escalation by       updating golang.org/x/net to version 0.55.0 (bsc#1266600)

    - Update to version 11.6.14+security-04:
      Security:
      * CVE-2026-28374: Fix insecure direct object reference in         Annotations API (bsc#1265290)
      * CVE-2026-28376: Fix unbounded memory allocation in Grafana Live         push endpoint (bsc#1265289)
      * CVE-2026-28383: Fix unbounded memory allocation in Grafana         plugin resources (bsc#1265286)
      * CVE-2026-28380: Fix broken access control in Snapshot API         (bsc#1265287)
      * CVE-2026-33376: Fix Auth Proxy IPv6 whitelist bypass         (bsc#1265285)
      * CVE-2026-28379: Fix viewer-triggered race condition in         Grafana Live (bsc#1265288)
      * CVE-2026-33377: Fix dashboard Editor Privilege Escalation         (bsc#1265284)
      * CVE-2026-33378: Fix OOM exception in Grafana Data Source Plugin         (bsc#1265283)
      * CVE-2026-33381: Prevent users from generating Service Account         tokens after permissions removal (bsc#1265281)
      * CVE-2026-33380: Fix vulnerability in SQL Expressions allowing         an authenticated attacker to read arbitrary files from the         Grafana servers filesystem (bsc#1265282)

    - CVE-2026-34986: Fix panic in JWE decryption (bsc#1262950)
    - CVE-2026-41602: Fix Integer Overflow or Wraparound vulnerability       in Apache Thrift (bsc#1263501)

    - CVE-2026-26958: Bump filippo.io/edwards25519 to version 1.1.1       (bsc#1258595)
    - CVE-2026-21725: Fix missing UID when deleting datasource by name       (bsc#1258873)

    - Update to version 11.6.14+security-01:
      Security:
      * CVE-2026-33375: Fix denial of Service via out-of-memory         exhaustion in MSSQL data source plugin (bsc#1260881)

    - Update to version 11.6.14:
      Security:
      * CVE-2026-27876: Fix remote arbitrary code execution via chained         SQL Expressions (bsc#1261025)
      * CVE-2026-27877: Fix information disclosure of data-source         passwords via public dashboards (bsc#1261026)
      * CVE-2026-28375: Fix denial of service via testdata data-source         (bsc#1261029)
      * CVE-2026-27879: Fix denial of service via resample query         (bsc#1261027)
      * CVE-2026-33186: Fix authorization bypass due to improper         validation of the HTTP/2 :path pseudo-header (bsc#1260263)
      * CVE-2026-21724: Fix authorization bypass allows modification of         protected webhook URLs (bsc#1260878)

    - Update to version 11.6.13:
      Enhancement:
      * Wire the public dashboard service to the HTTP server

    - Update to version 11.6.12:
      Enhancement:
      * Update authentication redirect logic       Bug fix:
      * Fix single panel render with variable references

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0383-1 advisory.

    Security fixes:

    - CVE-2025-58058: Fixed github.com/ulikunitz/xz leaks memory (bsc#1248910)
    - CVE-2025-29923: Fixed potential out of order responses when `CLIENT SETINFO`       times out during connection establishment (bsc#1241153)

    Other fixes:

    - Update to version 1.4.3
    - Update to version 1.4.2
    - Update to version 1.4.1 (jsc#SLE-23476)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of keda installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-29923 advisory.

  - go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and     9.7.3, go-redis potentially responds out of order when `CLIENT SETINFO` times out during connection     establishment. This can happen when the client is configured to transmit its identity, there are network     connectivity issues, or the client was configured with aggressive timeouts. The problem occurs for     multiple use cases. For sticky connections, you receive persistent out-of-order responses for the lifetime     of the connection. All commands in the pipeline receive incorrect responses. When used with the default     ConnPool once a connection is returned after use with ConnPool#Put the read buffer will be checked and the     connection will be marked as bad due to the unread data. This means that at most one out-of-order response     before the connection is discarded. This issue is fixed in 9.5.5, 9.6.3, and 9.7.3. You can prevent the     vulnerability by setting the flag DisableIndentity to true when constructing the client instance.
    (CVE-2025-29923)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and     9.7.3, go-redis potentially responds out of order when `CLIENT SETINFO` times out during connection     establishment. This can happen when the client is configured to transmit its identity, there are network     connectivity issues, or the client was configured with aggressive timeouts. The problem occurs for     multiple use cases. For sticky connections, you receive persistent out-of-order responses for the lifetime     of the connection. All commands in the pipeline receive incorrect responses. When used with the default     ConnPool once a connection is returned after use with ConnPool#Put the read buffer will be checked and the     connection will be marked as bad due to the unread data. This means that at most one out-of-order response     before the connection is discarded. This issue is fixed in 9.5.5, 9.6.3, and 9.7.3. You can prevent the     vulnerability by setting the flag DisableIndentity to true when constructing the client instance.
    (CVE-2025-29923)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01989-1 advisory.

    golang-github-prometheus-prometheus was updated to version 2.53.4:

    - Security issues fixed:
      * CVE-2023-45288: Require Go >= 1.23 for building (bsc#1236516)
      * CVE-2025-22870: Bumped golang.org/x/net to version 0.39.0 (bsc#1238686)

    - Other bugs fixes from version 2.53.4:
      * Runtime: fixed GOGC being set to 0 when installed         with empty prometheus.yml file resulting high cpu usage
      * Scrape: fixed dropping valid metrics after previous         scrape failed

    prometheus-blackbox_exporter was updated from version 0.24.0 to 0.26.0 (jsc#PED-12872):

    - Security issues fixed:
      * CVE-2025-22870: Fixed proxy bypassing using IPv6 zone IDs (bsc#1238680)
      * CVE-2023-45288: Fixed closing connections when receiving too many headers (bsc#1236515)

    - Other changes from version 0.26.0:
      * Changes:
        - Replace go-kit/log with log/slog module.
      * Features:
        - Add metric to record tls ciphersuite negotiated during           handshake.
        - Add a way to export labels with content matched by the probe.
          Reports Certificate Serial number.
      * Enhancement:
        - Add stale workflow to start sync with stale.yaml in Prometheus.
      * Bug fixes:
        - Only register grpc TLS metrics on successful handshake.


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01991-1 advisory.

    grafana was updated from version 10.4.15 to 11.5.5 (jsc#PED-12918):

    - Security issues fixed:
        * CVE-2025-4123: Fix cross-site scripting vulnerability (bsc#1243714).
        * CVE-2025-22872: Bump golang.org/x/net/html (bsc#1241809)
        * CVE-2025-3580: Prevent unauthorized server admin deletion (bsc#1243672).
        * CVE-2025-29923: Bump github.com/redis/go-redis/v9 to 9.6.3.
        * CVE-2025-3454: Sanitize paths before evaluating access to route (bsc#1241683).
        * CVE-2025-2703: Fix built-in XY Chart plugin (bsc#1241687).
        * CVE-2025-22870: Bump golang.org/x/net (bsc#1238703).
        * CVE-2024-9476: Fix Migration Assistant issue (bsc#1233343)
        * CVE-2024-9264: SQL Expressions (bsc#1231844)
        * CVE-2023-45288: Bump golang.org/x/net (bsc#1236510)
        * CVE-2025-22870: Bump golang.org/x/net to version 0.37.0 (bsc#1238686)

    - Potential breaking changes in version 11.5.0:
        * Loki: Default to /labels API with query param instead of /series API.
    - Potential breaking changes in version 11.0.1:
        * If you had selected your language as 'Portugu?s Brasileiro'         previously, this will be reset. You have to select it again in         your Preferences for the fix to be applied and the translations         will then be shown.
    - Potential breaking changes in version 11.0.0:
        * AngularJS support is turned off by default.
        * Legacy alerting is entirely removed.
        * Subfolders cause very rare issues with folders which have           slashes in their names.
        * The input data source is removed.
        * Data sources: Responses which are associated with hidden           queries will be removed (filtered) by Grafana.
        * The URL which is generated when viewing an individual repeated           panel has changed.
        * React Router is deprecated.
        * The grafana/e2e testing tool is deprecated.

    - This update brings many new features, enhancements and fixes highlighted at:
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-5/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-4/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-3/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-2/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-1/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-0/

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01987-1 advisory.

    golang-github-prometheus-prometheus was updated to version 2.53.4:

    - Security issues fixed:
      * CVE-2023-45288: Require Go >= 1.23 for building (bsc#1236516)
      * CVE-2025-22870: Bumped golang.org/x/net to version 0.39.0 (bsc#1238686)

    - Other bugs fixes from version 2.53.4:
      * Runtime: fixed GOGC being set to 0 when installed         with empty prometheus.yml file resulting high cpu usage
      * Scrape: fixed dropping valid metrics after previous         scrape failed

    prometheus-blackbox_exporter was updated from version 0.24.0 to 0.26.0 (jsc#PED-12872):

    - Security issues fixed:
      * CVE-2025-22870: Fixed proxy bypassing using IPv6 zone IDs (bsc#1238680)
      * CVE-2023-45288: Fixed closing connections when receiving too many headers (bsc#1236515)

    - Other changes from version 0.26.0:
      * Changes:
        - Replace go-kit/log with log/slog module.
      * Features:
        - Add metric to record tls ciphersuite negotiated during           handshake.
        - Add a way to export labels with content matched by the probe.
          Reports Certificate Serial number.
      * Enhancement:
        - Add stale workflow to start sync with stale.yaml in Prometheus.
      * Bug fixes:
        - Only register grpc TLS metrics on successful handshake.

    - Other changes from version 0.25.0:
      * Features:
        - Allow to get Probe logs by target.
        - Log errors from probe.
      * Bug fixes:
        - Prevent logging confusing error message.
        - Explicit registration of internal exporter metrics.

    grafana was updated from version 10.4.15 to 11.5.5 (jsc#PED-12918):

    - Security issues fixed:
      * CVE-2025-4123: Fix cross-site scripting vulnerability (bsc#1243714).
      * CVE-2025-22872: Bump golang.org/x/net/html (bsc#1241809)
      * CVE-2025-3580: Prevent unauthorized server admin deletion (bsc#1243672).
      * CVE-2025-29923: Bump github.com/redis/go-redis/v9 to 9.6.3.
      * CVE-2025-3454: Sanitize paths before evaluating access to route (bsc#1241683).
      * CVE-2025-2703: Fix built-in XY Chart plugin (bsc#1241687).
      * CVE-2025-22870: Bump golang.org/x/net (bsc#1238703).
      * CVE-2024-9476: Fix Migration Assistant issue (bsc#1233343)
      * CVE-2024-9264: SQL Expressions (bsc#1231844)
      * CVE-2023-45288: Bump golang.org/x/net (bsc#1236510)
      * CVE-2025-22870: Bump golang.org/x/net to version 0.37.0 (bsc#1238686)

    - Potential breaking changes in version 11.5.0:
      * Loki: Default to /labels API with query param instead of /series API.

    - Potential breaking changes in version 11.0.1:
      * If you had selected your language as 'Portugu?s Brasileiro'         previously, this will be reset. You have to select it again in         your Preferences for the fix to be applied and the translations         will then be shown.

    - Potential breaking changes in version 11.0.0:
      * AngularJS support is turned off by default.
      * Legacy alerting is entirely removed.
      * Subfolders cause very rare issues with folders which have         slashes in their names.
      * The input data source is removed.
      * Data sources: Responses which are associated with hidden         queries will be removed (filtered) by Grafana.
      * The URL which is generated when viewing an individual repeated         panel has changed.
      * React Router is deprecated.
      * The grafana/e2e testing tool is deprecated.

    - This update brings many new features, enhancements and fixes highlighted at:
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-5/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-4/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-3/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-2/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-1/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-0/

    golang-github-prometheus-node_exporter was updated to version 1.9.1:

    - Security issues fixed:
      * CVE-2025-22870: Bumped golang.org/x/net to version 0.37.0 (bsc#1238686)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 300f86de-0e4d-11f0-ae40-b42e991fc52e advisory.

    security@golang.org reports:
    Matching of hosts against proxy patterns can improperly treat an             IPv6 zone ID as a hostname component.  For example, when the NO_PROXY             environment variable is set to *.example.com, a request             to [::1%25.example.com]:80` will incorrectly match and not             be proxied.
    go-redis is the official Redis client library for the Go programming             language.  Prior to 9.5.5, 9.6.3, and 9.7.3, go-redis potentially             responds out of order when `CLIENT SETINFO` times out during             connection establishment.  This can happen when the client is             configured to transmit its identity, there are network connectivity             issues, or the client was configured with aggressive timeouts.  The             problem occurs for multiple use cases.  For sticky connections, you             receive persistent out-of-order responses for the lifetime of the             connection.  All commands in the pipeline receive incorrect responses.
            When used with the default ConnPool once a connection is returned             after use with ConnPool#Put the read buffer will be checked and the             connection will be marked as bad due to the unread data.  This means             that at most one out-of-order response before the connection is             discarded.  This issue is fixed in 9.5.5, 9.6.3, and 9.7.3.  You             can prevent the vulnerability by setting the flag DisableIndentity             to true when constructing the client instance.
    golang-jwt is a Go implementation of JSON Web Tokens.  Prior to             5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a             call to strings.Split) its argument (which is untrusted data) on             periods.  As a result, in the face of a malicious request whose             Authorization header consists of Bearer followed by many period             characters, a call to that function incurs allocations to the tune             of O(n) bytes (where n stands for the length of the function's             argument), with a constant factor of about 16.  This issue is fixed             in 5.2.2 and 4.5.2.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and
    9.7.3, go-redis potentially responds out of order when `CLIENT SETINFO` times out during connection
    establishment. This can happen when the client is configured to transmit its identity, there are network
    connectivity issues, or the client was configured with aggressive timeouts. The problem occurs for
    multiple use cases. For sticky connections, you receive persistent out-of-order responses for the lifetime
    of the connection. All commands in the pipeline receive incorrect responses. When used with the default
    ConnPool once a connection is returned after use with ConnPool#Put the read buffer will be checked and the
    connection will be marked as bad due to the unread data. This means that at most one out-of-order response
    before the connection is discarded. This issue is fixed in 9.5.5, 9.6.3, and 9.7.3. You can prevent the
    vulnerability by setting the flag DisableIndentity to true when constructing the client instance.
    (CVE-2025-29923)

ID	Name	Product	Family	Type	Severity
321072	openSUSE 16 Security Update : grafana (openSUSE-SU-2026:20940-1)	Nessus	SuSE Local Security Checks	Local	medium
311761	openSUSE 16 Security Update : grafana (openSUSE-SU-2026:20654-1)	Nessus	SuSE Local Security Checks	Local	high
297972	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : rekor (SUSE-SU-2026:0383-1)	Nessus	SuSE Local Security Checks	Local	low
295057	Azure Linux 3.0 Security Update: keda (CVE-2025-29923)	Nessus	Azure Linux Local Security Checks	Local	low
251978	Linux Distros Unpatched Vulnerability : CVE-2025-29923	Nessus	Misc.	Local	low
240840	SUSE SLES15 / openSUSE 15 Security Update : Multi-Linux Manager Client Tools (SUSE-SU-2025:01989-1)	Nessus	SuSE Local Security Checks	Local	critical
240835	SUSE SLES15 / openSUSE 15 Security Update : grafana (SUSE-SU-2025:01991-1)	Nessus	SuSE Local Security Checks	Local	critical
240802	SUSE SLES12 Security Update : Multi-Linux Manager Client Tools (SUSE-SU-2025:01987-1)	Nessus	SuSE Local Security Checks	Local	critical
233659	FreeBSD : gitea -- Multiple vulnerabilities (300f86de-0e4d-11f0-ae40-b42e991fc52e)	Nessus	FreeBSD Local Security Checks	Local	medium
421168	SCA: security update for github.com/redis/go-redis/v9 (GHSA-92cp-5422-2mw7)	Tenable Cloud Security	SCA Checks	Local	low
421168	SCA: security update for github.com/redis/go-redis/v9 (GHSA-92cp-5422-2mw7)	Tenable Self-Hosted Container Security	SCA Checks	Local	low

Detections

Analytics

CVE-2025-29923

low

Tenable Plugins

medium

high

low

low

low

critical

critical

critical

medium

low

low