time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20364-1 advisory.

    - Update to version 0.2.8+116:
    - CVE-2026-25727: Update vendored crates to fix a date parser can lead to stack exhaustion in Time.
    (bsc#1257908)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-eb2fc8e93d advisory.

    Update to new release, includes updated dependencies that fix for a number of CVEs

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:0860-1 advisory.

    This update for python-maturin fixes the following issue:

    - CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack     exhaustion       (bsc#1257918).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-04f13ba6d8 advisory.

    Update to new release, includes updated dependencies that fix for a number of CVEs

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:20326-1 advisory.

    This update for virtiofsd fixes the following issue:

    - CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack     exhaustion       (bsc#1257912).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1ace5758de advisory.

    Updated to newest version fixing CVEs found in the previous one


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1445 advisory.

    time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is     provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion     is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC     2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario.
    A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned     rather than exhausting the stack. (CVE-2026-25727)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:0816-1 advisory.

    This update for virtiofsd fixes the following issue:

    - CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack     exhaustion       (bsc#1257912).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0806-1 advisory.

    Changes for SLES16-SAP_Migration:

    - Bump version: 2.1.30

    Changes for SLES16-Migration:

    - Bump version: 2.1.30

    Changes for suse-migration-sle16-activation:

    - Move script package to the main migration provider
    - Create lib file for common network-prereq tasks
    - Refactor mount_system service

    Changes for suse-migration-services:

    - Bump  to version: 2.1.30:
        * Update docinfo
        * Update doc/adoc/user_guide.adoc
        * Update documentation for 12-to-15 in pubclouds           Fix information about default service pack target.
        * Apply make black
        * Added black for code formatting
        * refactor: add `Zypper.install` wrapper           Add `Zypper.install` wrapper method for package installation
        * Fixed get_migration_target return behavior
        * fix: ensure NetworkManager is installed on the target system

    Changes for wicked2nm:

    - Update to version v1.4.1.

    Security issues fixed:
    - CVE-2026-25727: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion     (bsc#1257911).

    Other updates and bugfixes:
    - update bytes from 1.10.1 to 1.11.1
    - update time to 0.3.47

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:0819-1 advisory.

    This update for virtiofsd fixes the following issue:

    - CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack     exhaustion       (bsc#1257912).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of thunderbird installed on the remote host is prior to 140.7.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3177 advisory.

    time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is     provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion     is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC     2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario.
    A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned     rather than exhausting the stack. (CVE-2026-25727)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of firefox installed on the remote host is prior to 140.7.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2FIREFOX-2026-052 advisory.

    time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is     provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion     is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC     2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario.
    A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned     rather than exhausting the stack. (CVE-2026-25727)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0620-1 advisory.

    Update to version 0.10.0.

    Security issues fixed:

    - CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack     exhaustion (bsc#1257927).
    - CVE-2025-3416: openssl: Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate     (bsc#1242601).
    - CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded     (bcs#1243869).

    Other updates and bugfixes:

    - Update to version 0.10.0

      * fails to generate attestation reports on SEV-SNP guests with firmware API (bsc#1257877).
      * chore: updating tool version to 0.10.0
      * refactor(certs): remove redundant branch in file-write logic
      * Docs: Adding verify measure, host-data, report-data to docs
      * verify: verify measurent, host data, and report data attributes from the attestation report.
      * library: Updating sev library to 7.1.0
      * ci: replace deprecated gh actions
      * feat: multi-format integer parsing for key subcommand arguments
      * chore(main): remove unused import `clap::arg`
      * feat(fetch): add fetch crl subcommand
      * .github/lint: Bump toolchain version to 1.86
      * Bump rust version to 1.86
      * feat: bumping tool to version 0.9.2
      * fix(verify): silence mismatched_lifetime_syntaxes in SnpOid::oid
      * feat: support SEV-SNP ABI Spec 1.58 (bump sev to v6.3.0)
      * docs: restore and clarify Global Options section
      * doc: fix CL argument orders + address recent changes
      * fix(hyperv): downgrade VMPL check from error to warning
      * fix(report.rs): remove conflict check between --random flag and Hyper-V
      * fix(report.rs): Decouple runtime behavior from hyperv build feature
      * refactor: clarify --platform error message
      * docs: add Azure/Hyper-V build note for --platform
      * report: Writing Req Data as Binary (#101)
      * deps: bump virtee/sev to 6.2.1 (fix TCB-serialization bug) (#99)
      * Updating SEV library to 6.1.0 and updating version to 0.9.1
      * Update version (0.9.0)
      * HyperV: Fixing report command failure on Azure confidential VM
      * Removing intird and append requirement for kernel measurements (#93)
      * Updating to version 6 of library and fixing attestation (#89)
      * CI: Fixing create_release workflow (#91)
      * Minor update (0.8.3)
      * Adding build script
      * Update preattestation.rs
      * Fix certificate fetch bug for Turin
      * Minor update
      * Update bitfield to 0.15.0
      * Update to 0.8.1
      * Update asn1-rs and x509-parser
      * Update to 0.8.0
      * key: Fix guest_field_select typo
      * Adding Turin support and updating ASK cn

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-086a367966 advisory.

    Update `uv` and `python-uv-build` to 0.10.2. There are some minor breaking changes in `uv`; most users     should not have to change anything. See https://github.com/astral-sh/uv/blob/0.10.2/CHANGELOG.md for     details. There are no breaking changes to `python-uv-build`.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:0582-1 advisory.

    - CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack     exhaustion       (bsc#1257927).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:20245-1 advisory.

    - Update to version 1.4.1
    - CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack     exhaustion (bsc#1257908).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:0514-1 advisory.

    Update to version 0.7.2~0.

    Security issues fixed:

    - CVE-2026-25727: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion       (bsc#1257906).

    Other updates and bugfixes:

    - Update to version 0.7.2~0:

      * mention cargo-dist in README
      * commit Cargo.lock
      * bump which dev-dependency to 8.0.0
      * bump object to 0.37
      * Upgrade cargo_metadata to 0.23
      * Expand the set of dist platforms in config

    - Update to version 0.7.1~0:

      * Out out of unhelpful clippy lint
      * Satisfy clippy
      * Do not assume --crate-name and --out-dir are present in the rustc command, but show warnings if they     aren't
      * Run apt-get update before trying to install packages
      * run `cargo dist init` on dist 0.30
      * Drop allow-dirty from dist config, should no longer be needed
      * Reorder paragraphs in README
      * Note the maintenance transition for the go extraction library
      * Editing pass on the adopters: scanners
      * clarify Docker support
      * Cargo clippy fix
      * Add Wolfi OS and Chainguard to adopters
      * Update mentions around Anchore tooling
      * README and documentation updates for nightly
      * Bump dependency version in rust-audit-info
      * More work on docs
      * Nicer formatting on format revision documentation
      * Bump versions
      * regenerate JSON schema
      * cargo fmt
      * Document format field
      * Make it more clear that RawVersionInfo is private
      * Add format field to the serialized data
      * cargo clippy fix
      * Add special handling for proc macros to treat them as the build dependencies they are
      * Add a test to ensure proc macros are reported as build dependencies
      * Add a test fixture for a crate with a proc macro dependency
      * parse fully qualified package ID specs from SBOMs
      * select first discovered SBOM file
      * cargo sbom integration
      * Get rid of unmaintained wee_alloc in test code to make people's scanners misled by GHSA chill out
      * Don't fail plan workflow due to manually changed release.yml
      * Bump Ubuntu version to hopefully fix release.yml workflow
      * Add test for stripped binary
      * Bump version to 0.6.7
      * Populate changelog
      * README.md: add auditable2cdx, more consistency in text
      * Placate clippy
      * Do not emit -Wl if a bare linker is in use
      * Get rid of a compiler warning
      * Add bare linker detection function
      * drop boilerplate from test that's no longer relevant
      * Add support for recovering rustc codegen options
      * More lenient parsing of rustc arguments
      * More descriptive error message in case rustc is killed abruptly
      * change formatting to fit rustfmt
      * More descriptive error message in case cargo is killed
      * Update REPLACING_CARGO.md to fix #195
      * Clarify osv-scanner support in README
      * Include the command required to view metadata
      * Mention wasm-tools support
      * Switch from broken generic cache action to a Rust-specific one
      * Fill in various fields in auditable2cdx Cargo.toml
      * Include osv-scanner in the list, with a caveat
      * Add link to blint repo to README
      * Mention that blint supports our data
      * Consolidate target definitions
      * Account for WASM test dependencies changing, commit the Cargo.lock so they would stop doing that
      * Migrate to a maintained toolchain action
      * Fix author specification
      * Add link to repository to resolverver Cargo.toml
      * Bump resolverver to 0.1.0
      * Add resolverver crate to the tree

    - Update to version 0.6.6~0:

      * Note the `object` upgrade in the changelog
      * Upgrade cyclonedx-bom from 0.5 to 0.8 in auditable-cyclonedx
      * Upgrade object crate from 0.30 to 0.36 to reduce dependency footprint
      * Update dependencies in the lock file
      * Populate changelog
      * apply clippy lint
      * add another --emit parsing test
      * shorter code with cargo fmt
      * Actually fix cargo-c compatibility
      * Attempt to fix cargo-capi incompatibility
      * Refactoring in preparation for fixes
      * Also read the --emit flag to rustc
      * Fill in changelogs
      * Bump versions
      * Drop cfg'd out tests
      * Drop obsolete doc line
      * Move dependency cycle tests from auditable-serde to cargo-auditable crate
      * Remove cargo_metadata from auditable-serde API surface.
      * Apply clippy lint
      * Upgrade miniz_oxide to 0.8.0
      * Insulate our semver from miniz_oxide semver
      * Add support for Rust 2024 edition
      * Update tests
      * More robust OS detection for riscv feature detection
      * bump version
      * update changelog for auditable-extract 0.3.5
      * Fix wasm component auditable data extraction
      * Update blocker description in README.md
      * Add openSUSE to adopters
      * Update list of know adopters
      * Fix detection of `riscv64-linux-android` target features
      * Silence noisy lint
      * Bump version requirement in rust-audit-info
      * Fill in changelogs
      * Bump semver of auditable-info
      * Drop obsolete comment now that wasm is enabled by default
      * Remove dependency on cargo-lock
      * Brag about adoption in the README
      * Don't use LTO for cargo-dist builds to make them consistent with `cargo install` etc
      * Also build musl binaries
      * dist: update dist config for future releases
      * dist(cargo-auditable): ignore auditable2cdx for now
      * chore: add cargo-dist

    - Update to version 0.6.4~0:

      * Release cargo-auditable v0.6.4
      * Correctly attribute changelog file addition in changelog
      * Add changelog for auditable-extract
      * Verify various feature combinations in CI
      * Upgrade wasmparser to remove dependencies with `unsafe`
      * Add LoongArch support
      * cargo fmt
      * Move doc headers to README.md and point rustdoc to them, so that we have nice crates.io pages
      * Expand on the note about WebAssembly parsing
      * Populate changelogs
      * Resume bragging about all dependencies being safe, now that there is a caveat below
      * drop fuzz Cargo.lock to always fuzz against latest versions
      * Bump `cargo auditable` version
      * Mention WASM support in README
      * Revert 'Be super duper extra sure both MinGW and MSVC are tested on CI'
      * Be super duper extra sure both MinGW and MSVC are tested on CI
      * Add wasm32 targets to CI for more platforms
      * Don't pass --target twice in tests
      * Install WASM toolchain in CI
      * cargo fmt
      * Add WASM end-to-end test
      * cargo fmt
      * Update documentation to mention the WASM feature
      * cargo fmt
      * Plumb WASM parsing feature through the whole stack
      * Make WASM parsing an optional, non-default feature
      * Add a fuzzing harness for WASM parsing
      * Rewritten WASM parsing to avoid heap allocations
      * Initial WASM extraction support
      * Nicer assertion
      * Drop obsolete comment
      * Clarify that embedding the compiler version has shipped.
      * Fixed section name for WASM
      * Unified and more robust platform detection. Fixed wasm build process
      * Initial WASM support
      * More robust platform detection for picking the binary format
      * Fix Windows CI to run both -msvc and -gnu
      * Use the correct link.exe flag for preserving the specified symbol even if it is unused
      * Fix Windows
      * Fix tests on Rust 1.77
      * Placate clippy
      * Oopps, I meant components field
      * Also remove the dependencies field if empty
      * Use serde_json with order preservation feature to get a more compressible JSON after workarounds
      * Work around cyclonedx-bom limitations to produce minified JSON
      * Also record the dependency kind
      * cyclonedx-bom: also record PURL
      * Also write the dependency tree
      * Clear the serial number in the minimal CycloneDX variant
      * Prototype impl of auditable2cdx
      * Fill in auditable2cdx dependencies
      * Initial auditable2cdx boilerplace
      * add #![forbid(unsafe_code)]
      * Initial implementation of auditable-to-cyclonedx conversion
      * Add the necessary dependencies to auditable-cyclonedx
      * Initial dummy package for auditable-cyclonedx

    - Update to version 0.6.2~0:

      * Update the lockfile
      * New releases of cargo-auditable and auditable-serde
      * Use a separate project for the custom rustc path tests. Fixes intermittent test failures due to race     conditions
      * Revert 'add commit hashes to git sources'
      * Fix cyclic dependency graph being encoded
      * Revert 'An unsuccessful attempt to fix cycles caused by dev-dependencies'
      * An unsuccessful attempt to fix cycles caused by dev-dependencies
      * Fix typo
      * Add comment
      * Add a test for an issue with cyclic dependencies reported at     https://github.com/rustsec/rustsec/issues/1043
      * Fix auditable-serde example not building
      * upgrade dependency miniz_oxide to 0.6.0
      * fix formatting errors
      * apply clippy lints for --all-features
      * improve the internal docs and comments
      * apply clippy lints
      * add missing sources for one of test fixtures
      * add commit hashes to git sources
      * Run all tests on CI
      * cargo fmt
      * Run `cargo clean` in tests to get rid of stale binaries
      * Fix date in changelog
      * Populate changelog
      * Bump auditable-info version in rust-audit-info
      * Add auditable-info changelog
      * Bump versions following cargo-lock bump
      * auditable-serde: bump `cargo-lock` to v9
      * switch to UNRELEASED
      * Update CHANGELOG.md
      * Print a better error if calling rustc fails
      * Drop unused import
      * placate Clippy
      * Don't inject audit info if --print argument is passed to rustc
      * Reflect the version change in Cargo.lock
      * Remove space from keywords
      * bump version to 0.6.1
      * Fix date in changelog
      * Update CHANGELOG.md
      * Add publish=false
      * Commit the generated manpage
      * Add the code for generating a manpage; rather rudimentary so far, but it's a starting point
      * Explain relation to supply chain attacks
      * Add keywords to the Cargo manifest
      * Revert 'generate a man page for cargo auditable'
      * fix formatting
      * fix review feedback, relocate file to under OUT_DIR, don't use anyhow and also commit the lock file
      * generate a man page for cargo auditable
      * Add Clippy suppression
      * placate clippy
      * commit Cargo.lock
      * Sync to latest object file writing code from rustc
      * Fix examples in docs
      * Allow redundant field names
      * Apply clippy suggestion: match -> if let
      * Check for clippy and format in CI
      * Apply clippy suggestions
      * Run CI with --locked

    - Update to version 0.6.0~0:

      * README and documentation improvements
      * Read the rustc path passed by Cargo; fixes #90
      * Read location of Cargo from the environment variable Cargo sets for third-party subcommands
      * Add a note on sccache version compatibility to CHANGELOG.md
      * Panic on compilation commands where we fail to parse the arguments instead of silently ignoring the     error
      * Specifying the binary-scanning feature is no longer needed
      * Pass options such as --offline to `cargo metadata`
      * Pass on arguments from `cargo auditable` invocation to the rustc wrapper; prep work towards fixing #83
      * Bump rust-audit-info to 0.5.2
      * Bump auditable-serde version to 0.5.2
      * Correctly fill in the source even in dependency entries when converting to cargo-lock data format
      * Drop the roundtrip through str in semver::Version
      * Release auditable-info 0.6.1
      * Bump all the version requirements for things depending on auditable-info
      * Fix audit_info_from_slice function signature

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:0505-1 advisory.

    Update to version 0.7.2~0.

    Security issues fixed:

    - CVE-2026-25727: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion       (bsc#1257906).

    Other updates and bugfixes:

    - Update to version 0.7.2~0:

      * mention cargo-dist in README
      * commit Cargo.lock
      * bump which dev-dependency to 8.0.0
      * bump object to 0.37
      * Upgrade cargo_metadata to 0.23
      * Expand the set of dist platforms in config

    - Update to version 0.7.1~0:

      * Out out of unhelpful clippy lint
      * Satisfy clippy
      * Do not assume --crate-name and --out-dir are present in the rustc command, but show warnings if they     aren't
      * Run apt-get update before trying to install packages
      * run `cargo dist init` on dist 0.30
      * Drop allow-dirty from dist config, should no longer be needed
      * Reorder paragraphs in README
      * Note the maintenance transition for the go extraction library
      * Editing pass on the adopters: scanners
      * clarify Docker support
      * Cargo clippy fix
      * Add Wolfi OS and Chainguard to adopters
      * Update mentions around Anchore tooling
      * README and documentation updates for nightly
      * Bump dependency version in rust-audit-info
      * More work on docs
      * Nicer formatting on format revision documentation
      * Bump versions
      * regenerate JSON schema
      * cargo fmt
      * Document format field
      * Make it more clear that RawVersionInfo is private
      * Add format field to the serialized data
      * cargo clippy fix
      * Add special handling for proc macros to treat them as the build dependencies they are
      * Add a test to ensure proc macros are reported as build dependencies
      * Add a test fixture for a crate with a proc macro dependency
      * parse fully qualified package ID specs from SBOMs
      * select first discovered SBOM file
      * cargo sbom integration
      * Get rid of unmaintained wee_alloc in test code to make people's scanners misled by GHSA chill out
      * Don't fail plan workflow due to manually changed release.yml
      * Bump Ubuntu version to hopefully fix release.yml workflow
      * Add test for stripped binary
      * Bump version to 0.6.7
      * Populate changelog
      * README.md: add auditable2cdx, more consistency in text
      * Placate clippy
      * Do not emit -Wl if a bare linker is in use
      * Get rid of a compiler warning
      * Add bare linker detection function
      * drop boilerplate from test that's no longer relevant
      * Add support for recovering rustc codegen options
      * More lenient parsing of rustc arguments
      * More descriptive error message in case rustc is killed abruptly
      * change formatting to fit rustfmt
      * More descriptive error message in case cargo is killed
      * Update REPLACING_CARGO.md to fix #195
      * Clarify osv-scanner support in README
      * Include the command required to view metadata
      * Mention wasm-tools support
      * Switch from broken generic cache action to a Rust-specific one
      * Fill in various fields in auditable2cdx Cargo.toml
      * Include osv-scanner in the list, with a caveat
      * Add link to blint repo to README
      * Mention that blint supports our data
      * Consolidate target definitions
      * Account for WASM test dependencies changing, commit the Cargo.lock so they would stop doing that
      * Migrate to a maintained toolchain action
      * Fix author specification
      * Add link to repository to resolverver Cargo.toml
      * Bump resolverver to 0.1.0
      * Add resolverver crate to the tree

    - Update to version 0.6.6~0:

      * Note the `object` upgrade in the changelog
      * Upgrade cyclonedx-bom from 0.5 to 0.8 in auditable-cyclonedx
      * Upgrade object crate from 0.30 to 0.36 to reduce dependency footprint
      * Update dependencies in the lock file
      * Populate changelog
      * apply clippy lint
      * add another --emit parsing test
      * shorter code with cargo fmt
      * Actually fix cargo-c compatibility
      * Attempt to fix cargo-capi incompatibility
      * Refactoring in preparation for fixes
      * Also read the --emit flag to rustc
      * Fill in changelogs
      * Bump versions
      * Drop cfg'd out tests
      * Drop obsolete doc line
      * Move dependency cycle tests from auditable-serde to cargo-auditable crate
      * Remove cargo_metadata from auditable-serde API surface.
      * Apply clippy lint
      * Upgrade miniz_oxide to 0.8.0
      * Insulate our semver from miniz_oxide semver
      * Add support for Rust 2024 edition
      * Update tests
      * More robust OS detection for riscv feature detection
      * bump version
      * update changelog for auditable-extract 0.3.5
      * Fix wasm component auditable data extraction
      * Update blocker description in README.md
      * Add openSUSE to adopters
      * Update list of know adopters
      * Fix detection of `riscv64-linux-android` target features
      * Silence noisy lint
      * Bump version requirement in rust-audit-info
      * Fill in changelogs
      * Bump semver of auditable-info
      * Drop obsolete comment now that wasm is enabled by default
      * Remove dependency on cargo-lock
      * Brag about adoption in the README
      * Don't use LTO for cargo-dist builds to make them consistent with `cargo install` etc
      * Also build musl binaries
      * dist: update dist config for future releases
      * dist(cargo-auditable): ignore auditable2cdx for now
      * chore: add cargo-dist

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:0506-1 advisory.

    Update to version 0.7.2~0.

    Security issues fixed:

    - CVE-2026-25727: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion       (bsc#1257906).

    Other updates and bugfixes:

    - Update to version 0.7.2~0:

      * mention cargo-dist in README
      * commit Cargo.lock
      * bump which dev-dependency to 8.0.0
      * bump object to 0.37
      * Upgrade cargo_metadata to 0.23
      * Expand the set of dist platforms in config

    - Update to version 0.7.1~0:

      * Out out of unhelpful clippy lint
      * Satisfy clippy
      * Do not assume --crate-name and --out-dir are present in the rustc command, but show warnings if they     aren't
      * Run apt-get update before trying to install packages
      * run `cargo dist init` on dist 0.30
      * Drop allow-dirty from dist config, should no longer be needed
      * Reorder paragraphs in README
      * Note the maintenance transition for the go extraction library
      * Editing pass on the adopters: scanners
      * clarify Docker support
      * Cargo clippy fix
      * Add Wolfi OS and Chainguard to adopters
      * Update mentions around Anchore tooling
      * README and documentation updates for nightly
      * Bump dependency version in rust-audit-info
      * More work on docs
      * Nicer formatting on format revision documentation
      * Bump versions
      * regenerate JSON schema
      * cargo fmt
      * Document format field
      * Make it more clear that RawVersionInfo is private
      * Add format field to the serialized data
      * cargo clippy fix
      * Add special handling for proc macros to treat them as the build dependencies they are
      * Add a test to ensure proc macros are reported as build dependencies
      * Add a test fixture for a crate with a proc macro dependency
      * parse fully qualified package ID specs from SBOMs
      * select first discovered SBOM file
      * cargo sbom integration
      * Get rid of unmaintained wee_alloc in test code to make people's scanners misled by GHSA chill out
      * Don't fail plan workflow due to manually changed release.yml
      * Bump Ubuntu version to hopefully fix release.yml workflow
      * Add test for stripped binary
      * Bump version to 0.6.7
      * Populate changelog
      * README.md: add auditable2cdx, more consistency in text
      * Placate clippy
      * Do not emit -Wl if a bare linker is in use
      * Get rid of a compiler warning
      * Add bare linker detection function
      * drop boilerplate from test that's no longer relevant
      * Add support for recovering rustc codegen options
      * More lenient parsing of rustc arguments
      * More descriptive error message in case rustc is killed abruptly
      * change formatting to fit rustfmt
      * More descriptive error message in case cargo is killed
      * Update REPLACING_CARGO.md to fix #195
      * Clarify osv-scanner support in README
      * Include the command required to view metadata
      * Mention wasm-tools support
      * Switch from broken generic cache action to a Rust-specific one
      * Fill in various fields in auditable2cdx Cargo.toml
      * Include osv-scanner in the list, with a caveat
      * Add link to blint repo to README
      * Mention that blint supports our data
      * Consolidate target definitions
      * Account for WASM test dependencies changing, commit the Cargo.lock so they would stop doing that
      * Migrate to a maintained toolchain action
      * Fix author specification
      * Add link to repository to resolverver Cargo.toml
      * Bump resolverver to 0.1.0
      * Add resolverver crate to the tree

    - Update to version 0.6.6~0:

      * Note the `object` upgrade in the changelog
      * Upgrade cyclonedx-bom from 0.5 to 0.8 in auditable-cyclonedx
      * Upgrade object crate from 0.30 to 0.36 to reduce dependency footprint
      * Update dependencies in the lock file
      * Populate changelog
      * apply clippy lint
      * add another --emit parsing test
      * shorter code with cargo fmt
      * Actually fix cargo-c compatibility
      * Attempt to fix cargo-capi incompatibility
      * Refactoring in preparation for fixes
      * Also read the --emit flag to rustc
      * Fill in changelogs
      * Bump versions
      * Drop cfg'd out tests
      * Drop obsolete doc line
      * Move dependency cycle tests from auditable-serde to cargo-auditable crate
      * Remove cargo_metadata from auditable-serde API surface.
      * Apply clippy lint
      * Upgrade miniz_oxide to 0.8.0
      * Insulate our semver from miniz_oxide semver
      * Add support for Rust 2024 edition
      * Update tests
      * More robust OS detection for riscv feature detection
      * bump version
      * update changelog for auditable-extract 0.3.5
      * Fix wasm component auditable data extraction
      * Update blocker description in README.md
      * Add openSUSE to adopters
      * Update list of know adopters
      * Fix detection of `riscv64-linux-android` target features
      * Silence noisy lint
      * Bump version requirement in rust-audit-info
      * Fill in changelogs
      * Bump semver of auditable-info
      * Drop obsolete comment now that wasm is enabled by default
      * Remove dependency on cargo-lock
      * Brag about adoption in the README
      * Don't use LTO for cargo-dist builds to make them consistent with `cargo install` etc
      * Also build musl binaries
      * dist: update dist config for future releases
      * dist(cargo-auditable): ignore auditable2cdx for now
      * chore: add cargo-dist

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-6388b28850 advisory.

    - Update the time crate to version 0.3.47.
    - Update the time-macros crate to version 0.2.27.
    - Update the time-core crate to version 0.1.8.
    - Update the num-conv crate to version 0.2.0.
    - Update the git2 crate to version 0.20.4.
    - Update the bytes crate to version 1.11.1.

    Additionally, this update contains rebuilds of applications affected by security advisories:

    - bytes: [RUSTSEC-2026-0007](https://rustsec.org/advisories/RUSTSEC-2026-0007.html)
    - git2: [RUSTSEC-2026-0008](https://rustsec.org/advisories/RUSTSEC-2026-0008.html)
    - jsonwebtoken: [CVE-2026-25537](https://www.cve.org/CVERecord?id=CVE-2026-25537)
    - time: [RUSTSEC-2026-0009](https://rustsec.org/advisories/RUSTSEC-2026-0009.html)

    All applications that statically link libgit2 via the `git2` Rust bindings were also rebuilt against the     latest version of the `git2` / `libgit2-sys` crates to pull in fixes included in libgit2 between v1.8.1     and v1.9.2.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-a92ff0085d advisory.

    Automatic update for selenium-manager-4.34.0-6.fc45.

    ##### **Changelog**

    ```
    * Tue Feb 10 2026 tjuhasz <tjuhasz@redhat.com> - 4.34.0-6
    - Rebuild for  CVE-2026-25727 (rhbz#2438154)

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-f400579a21 advisory.

    - Update the time crate to version 0.3.47.
    - Update the time-macros crate to version 0.2.27.
    - Update the time-core crate to version 0.1.8.
    - Update the num-conv crate to version 0.2.0.
    - Update the git2 crate to version 0.20.4.
    - Update the bytes crate to version 1.11.1.

    Additionally, this update contains rebuilds of applications affected by security advisories:

    - bytes: [RUSTSEC-2026-0007](https://rustsec.org/advisories/RUSTSEC-2026-0007.html)
    - git2: [RUSTSEC-2026-0008](https://rustsec.org/advisories/RUSTSEC-2026-0008.html)
    - jsonwebtoken: [CVE-2026-25537](https://www.cve.org/CVERecord?id=CVE-2026-25537)
    - time: [RUSTSEC-2026-0009](https://rustsec.org/advisories/RUSTSEC-2026-0009.html)

    All applications that statically link libgit2 via the `git2` Rust bindings were also rebuilt against the     latest version of the `git2` / `libgit2-sys` crates to pull in fixes included in libgit2 between v1.8.1     and v1.9.2.




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is     provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion     is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC     2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario.
    A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned     rather than exhausting the stack. (CVE-2026-25727)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
303019	openSUSE 16 Security Update : rust-keylime (openSUSE-SU-2026:20364-1)	Nessus	SuSE Local Security Checks	medium
302129	Fedora 43 : task (2026-eb2fc8e93d)	Nessus	Fedora Local Security Checks	high
302099	openSUSE 15 Security Update : python-maturin (SUSE-SU-2026:0860-1)	Nessus	SuSE Local Security Checks	medium
302047	Fedora 44 : task (2026-04f13ba6d8)	Nessus	Fedora Local Security Checks	high
301474	openSUSE 16 Security Update : virtiofsd (openSUSE-SU-2026:20326-1)	Nessus	SuSE Local Security Checks	medium
301430	Fedora 44 : postgresql16-anonymizer (2026-1ace5758de)	Nessus	Fedora Local Security Checks	medium
301353	Amazon Linux 2023 : firefox (ALAS2023-2026-1445)	Nessus	Amazon Linux Local Security Checks	medium
301303	SUSE SLES15 / openSUSE 15 Security Update : virtiofsd (SUSE-SU-2026:0816-1)	Nessus	SuSE Local Security Checks	medium
301293	SUSE SLED15 / SLES15 Security Update : wicked2nm,suse-migration-services,suse-migration-sle16-activation,SLES16-Migration,SLES16-SAP_Migration (SUSE-SU-2026:0806-1)	Nessus	SuSE Local Security Checks	medium
301286	SUSE SLED15 / SLES15 Security Update : virtiofsd (SUSE-SU-2026:0819-1)	Nessus	SuSE Local Security Checks	medium
301264	Amazon Linux 2 : thunderbird, --advisory ALAS2-2026-3177 (ALAS-2026-3177)	Nessus	Amazon Linux Local Security Checks	medium
301254	Amazon Linux 2 : firefox, --advisory ALAS2FIREFOX-2026-052 (ALASFIREFOX-2026-052)	Nessus	Amazon Linux Local Security Checks	medium
300120	SUSE SLES15 Security Update : snpguest (SUSE-SU-2026:0620-1)	Nessus	SuSE Local Security Checks	medium
299742	Fedora 42 : python-uv-build / rust-ambient-id / uv (2026-086a367966)	Nessus	Fedora Local Security Checks	medium
299713	SUSE SLES15 / openSUSE 15 Security Update : snpguest (SUSE-SU-2026:0582-1)	Nessus	SuSE Local Security Checks	medium
299653	openSUSE 16 Security Update : wicked2nm (openSUSE-SU-2026:20245-1)	Nessus	SuSE Local Security Checks	medium
299047	SUSE SLES15 Security Update : cargo-auditable (SUSE-SU-2026:0514-1)	Nessus	SuSE Local Security Checks	medium
299043	SUSE SLES15 / openSUSE 15 Security Update : cargo-auditable (SUSE-SU-2026:0505-1)	Nessus	SuSE Local Security Checks	medium
299042	SUSE SLED15 / SLES15 Security Update : cargo-auditable (SUSE-SU-2026:0506-1)	Nessus	SuSE Local Security Checks	medium
298573	Fedora 42 : atuin / bustle / envision / glycin / greetd / helix / etc (2026-6388b28850)	Nessus	Fedora Local Security Checks	medium
298497	Fedora 45 : selenium-manager (2026-a92ff0085d)	Nessus	Fedora Local Security Checks	medium
298446	Fedora 43 : asciinema / atuin / bustle / envision / glycin / greetd / helix / etc (2026-f400579a21)	Nessus	Fedora Local Security Checks	medium
298198	Linux Distros Unpatched Vulnerability : CVE-2026-25727	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-25727

medium

Tenable Plugins

medium

high

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium