Debian Linux - golang-1.15 - None

golang-1.19 - None

golang-1.24 - None

golang-1.25 - None

Ubuntu Linux - [encoding/pem: quadratic complexity when parsing some invalid inputs]

splunk SVD-2025-0604: Third-Party Package Updates in Splunk Universal Forwarder - June 2025

splunk SVD-2025-0710: Third-Party Package Updates in Splunk Enterprise - July 2025

The version of Golang running on the remote host is 1.24.x prior to 1.24.8, 1.25.x prior to 1.25.2. It is, therefore, affected by multiple vulnerabilities as referenced in qZN5nc-mBgAJ advisory.

  - The Parse function permitted values other than IPv6 addresses to be included in square brackets within     the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component,     enclosed within square brackets. For example: 'http://[::1]/'. IPv4 addresses and hostnames must not     appear within square brackets. Parse did not enforce this requirement. (CVE-2025-47912)

  - tar.Reader did not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0     sparse files. A maliciously-crafted archive containing a large number of sparse regions could cause a     Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed     source, a small compressed input could result in large allocations. (CVE-2025-58183)

  - Validating certificate chains which contain DSA public keys can cause programs to panic, due to a     interface cast that assumes they implement the Equal method. This affects programs which validate     arbitrary certificate chains. (CVE-2025-58188)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:3682-1 advisory.

    go1.24.9 (released 2025-10-13) includes fixes to the crypto/x509     package. (bsc#1236217)

    * crypto/x509: TLS validation fails for FQDNs with trailing dot

    go1.24.8 (released 2025-10-07) includes security fixes to the     archive/tar, crypto/tls, crypto/x509, encoding/asn1,     encoding/pem, net/http, net/mail, net/textproto, and net/url     packages, as well as bug fixes to the compiler, the linker, and     the debug/pe, net/http, os, and sync/atomic packages.
    (bsc#1236217)

      CVE-2025-58189 CVE-2025-61725 CVE-2025-58188 CVE-2025-58185 CVE-2025-58186 CVE-2025-61723 CVE-2025-58183     CVE-2025-47912 CVE-2025-58187 CVE-2025-61724:

      * bsc#1251255 CVE-2025-58189: crypto/tls: ALPN negotiation error contains attacker controlled     information
      * bsc#1251253 CVE-2025-61725: net/mail: excessive CPU consumption in ParseAddress
      * bsc#1251260 CVE-2025-58188: crypto/x509: panic when validating certificates with DSA public keys
      * bsc#1251258 CVE-2025-58185: encoding/asn1: pre-allocating memory when parsing DER payload can cause     memory exhaustion
      * bsc#1251259 CVE-2025-58186: net/http: lack of limit when parsing cookies can cause memory exhaustion
      * bsc#1251256 CVE-2025-61723: encoding/pem: quadratic complexity when parsing some invalid inputs
      * bsc#1251261 CVE-2025-58183: archive/tar: unbounded allocation when parsing GNU sparse map
      * bsc#1251257 CVE-2025-47912: net/url: insufficient validation of bracketed IPv6 hostnames
      * bsc#1251254 CVE-2025-58187: crypto/x509: quadratic complexity when checking name constraints
      * bsc#1251262 CVE-2025-61724: net/textproto: excessive CPU consumption in Reader.ReadResponse
      * os: Root.OpenRoot sets incorrect name, losing prefix of original root
      * debug/pe: pe.Open fails on object files produced by llvm-mingw 21
      * cmd/link: panic on riscv64 with CGO enabled due to empty container symbol
      * net: new test TestIPv4WriteMsgUDPAddrPortTargetAddrIPVersion fails on plan9
      * os: new test TestOpenFileCreateExclDanglingSymlink fails on Plan 9
      * crypto/internal/fips140/rsa: requires a panic if self-tests fail
      * net/http: internal error: connCount underflow
      * cmd/compile: internal compiler error with GOEXPERIMENT=cgocheck2 on github.com/leodido/go-urn
      * sync/atomic: comment for Uintptr.Or incorrectly describes return value

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03547-1 advisory.

    go1.25.2 (released 2025-10-07) includes security fixes to the     archive/tar, crypto/tls, crypto/x509, encoding/asn1,     encoding/pem, net/http, net/mail, net/textproto, and net/url     packages, as well as bug fixes to the compiler, the runtime, and     the context, debug/pe, net/http, os, and sync/atomic packages.  (bsc#1244485)

      CVE-2025-58189 CVE-2025-61725 CVE-2025-58188 CVE-2025-58185 CVE-2025-58186 CVE-2025-61723 CVE-2025-58183     CVE-2025-47912 CVE-2025-58187 CVE-2025-61724:

      * bsc#1251255 CVE-2025-58189: crypto/tls: ALPN negotiation error contains attacker controlled     information
      * bsc#1251253 CVE-2025-61725: net/mail: excessive CPU consumption in ParseAddress
      * bsc#1251260 CVE-2025-58188: crypto/x509: panic when validating certificates with DSA public keys
      * bsc#1251258 CVE-2025-58185: encoding/asn1: pre-allocating memory when parsing DER payload can cause     memory exhaustion
      * bsc#1251259 CVE-2025-58186: net/http: lack of limit when parsing cookies can cause memory exhaustion
      * bsc#1251256 CVE-2025-61723: encoding/pem: quadratic complexity when parsing some invalid inputs
      * bsc#1251261 CVE-2025-58183: archive/tar: unbounded allocation when parsing GNU sparse map
      * bsc#1251257 CVE-2025-47912: net/url: insufficient validation of bracketed IPv6 hostnames
      * bsc#1251254 CVE-2025-58187: crypto/x509: quadratic complexity when checking name constraints
      * bsc#1251262 CVE-2025-61724: net/textproto: excessive CPU consumption in Reader.ReadResponse

      * go#75111 os, syscall: volume handles with FILE_FLAG_OVERLAPPED fail when calling ReadAt
      * go#75116 os: Root.MkdirAll can return 'file exists' when called concurrently on the same path
      * go#75139 os: Root.OpenRoot sets incorrect name, losing prefix of original root
      * go#75221 debug/pe: pe.Open fails on object files produced by llvm-mingw 21
      * go#75255 cmd/compile: export to DWARF types only referenced through interfaces
      * go#75347 testing/synctest: test timeout with no runnable goroutines
      * go#75357 net: new test TestIPv4WriteMsgUDPAddrPortTargetAddrIPVersion fails on plan9
      * go#75524 crypto/internal/fips140/rsa: requires a panic if self-tests fail
      * go#75537 context: Err can return non-nil before Done channel is closed
      * go#75539 net/http: internal error: connCount underflow
      * go#75595 cmd/compile: internal compiler error with GOEXPERIMENT=cgocheck2 on github.com/leodido/go-urn
      * go#75610 sync/atomic: comment for Uintptr.Or incorrectly describes return value
      * go#75669 runtime: debug.decoratemappings don't work as expected

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Debian Linux - golang-1.15 - None  golang-1.19 - None  golang-1.23 - None  golang-1.24 - None  golang-1.25
    - None (CVE-2025-61723)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
271201	Golang 1.24.x < 1.24.8 / 1.25.x < 1.25.2 Multiple Vulnerabilities (qZN5nc-mBgAJ)	Nessus	Misc.	high
270849	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.24 (SUSE-SU-2025:3682-1)	Nessus	SuSE Local Security Checks	high
270294	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.25 (SUSE-SU-2025:03547-1)	Nessus	SuSE Local Security Checks	high
270214	Linux Distros Unpatched Vulnerability : CVE-2025-61723	Nessus	Misc.	critical

Detections

Analytics

CVE-2025-61723

medium

Tenable Plugins

Coming Soon

high

high

high

critical