go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2468-1 advisory.

    This update for amazon-ssm-agent fixes the following issues

    Update to version 3.3.4624.0:

    - CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of     golang.org/x/crypto/ssh       (bsc#1239342).
    - CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
    - CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected     message type in       response to a key listing or signing request (bsc#1253611).
    - CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for     specific inputs       (bsc#1265474).
    - CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack     and .idx files       can lead to the consumption of corrupted files (bsc#1258095).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege esca (bsc#1266781).
    - CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following     redirects during       smart-HTTP clone and fetch operations (bsc#1264952).
    - CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to     DoS via infinite       loops, panics or resource consumption (bsc#1267332).
    - CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
    - CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in     golang.org/x/crypto/ssh       (bsc#1266200).
    - CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in     golang.org/x/crypto/ssh       (bsc#1266200).
    - CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent       (bsc#1266200).
    - CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
    - CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
    - CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in     golang.org/x/crypto/ssh/knownhosts       (bsc#1266200).
    - CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in     golang.org/x/crypto/ssh       (bsc#1266200).
    - CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent     (bsc#1266200).

    Changes:

     * Bump golang.org/x/crypto from v0.51.0 to v0.52.0
     * Bump golang.org/x/net from v0.54.0 to v0.55.0
     * Enforce directory boundary in BuildSafePath
     * Fix visibility issue with Bottlerocket OS in document output
     * Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this        also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
     * Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
     * Quit if sysprep failed and log its current state
     * Remove attached legacy cloudwatch plugin packages
     * Upgrade Go version to 1.25.10
     * Use BuildSafePath wherever it is applicable
     * Add OOM killer protection to systemd service files
     * Apply more sanitation to file and registry inventory gatherers
     * Bump go-git to v5.17.1
     * Deprecate legacy cloudwatch plugin
     * Preserve network error details in credential refresher SSM API failures
     * Upgrade Go version to 1.25.9
     * Add SSM Distributor support for Bottlerocket OS
     * Implement flush credentials command in ssm-cli
     * Log ec2messages access denied as debug instead of error to reduce log noise
     * Make credential refresher refresh cache quickly in case of credential flush
     * Make Greengrass component registration resilient with retry
     * Add EnforceWorkspaceRootOwnership configuration to support disable        hardening of agent workspace
     * Add reboot comment to Windows shutdown command for SSM Agent traceability
     * Update privilege access check to verify ownership and permissions        of document state files
     * Add read-only version check prior to install and uninstall        in case of occupied package manager locks
     * Add ANSI processing for CloudWatch and S3 log
     * Upgrade go-git to v5.17.0 and cloudflare/circl to v1.6.3        to fix CVE-2026-1229
    - Switch to systemd-tmpfiles to store runtime data (jsc#PED-14843)
     * Disable Go 1.25 container-aware GOMAXPROCS to prevent holding        cgroup file descriptors open
     * Upgrade Go version to 1.25.8
     * Document CommandWorkerBufferLimit config
     * Include package update in Dockerfile
     * Reduce CloudWatch event message length threshold
     * Upgrade Go version to 1.25.7
     * Update github.com/go-git/go-git/v5 to 5.16.5 (bsc#1258095, CVE-2026-25934)
     * Update greengrass version
     * Update Golang version to 1.24.12
     * Updating golang.org/x/crypto from v0.37.0 to v0.47.0, golang.org/x/net        from v0.39.0 to v0.48.0 and golang.org/x/sys from v0.32.0 to v0.40.0        (bsc#1253611, CVE-2025-47913)
     * Categorize integration tests by adding new tags to split fast and slow ones
     * Fix bug where IP field being empty string and causing UII API failure
     * Allow Patch execution to persist across reboots not registered to SSM Agent
     * Fix ENV_VAR interpolation to work correctly with parameter store value
     * Implement immediate retries for failed reply messages to MGS for RunCommand documents
     * Improve ssm-cli get-diagnostics command log output
     * Support DomainJoin endpoint for EU sovereign cloud
     * Support dualstack S3 endpoint for distributor packages
     * Upgrade Go version to 1.24.11
     * Add initial IPv6 support with UseDualStackEndpoint configuration option
     * Fix CPU utilization issue for instances with thousands of network interfaces
     * Add IMDS retry count to account for EC2 droplet refresh
     * Fix duplicate uid error logging in MDS module
     * Update aws:Domainjoin plugin logging from Log4Net to NLog
     * Upgrade Go version to 1.24.7
     * Update github.com/go-git/go-git/v5 to 5.15.0
     * Update golang.org/x/crypto to v0.37.0 (bsc#1238702, CVE-2025-22870)
     * Update golang.org/x/net to v0.39.0
     * Update golang.org/x/sys to v0.32.0
     * Add EU sovereign cloud S3 endpoint for DownloadContent plugin
     * Add configurable credential rotation max backoff interval
     * Migrate from twinj/uuid to google/uuid library
     * Allow newer agent versions to be installed when deploying on Greengrass
     * Harden function to remove non-admin run command documents in execution path
     * Fix macOS credential refresher test issue due to missing Debugf from serialport skip file
     * Enhance testability of custom certificate usage in debug SSM Agent builds
     * Decouple serial port from startup and add credential refresher serialport logging
     * Add GlobalEnhancedTelemetryEnabled config to README
     * Add cloudwatch logs endpoint configuration to optional config for agent
     * Update Greengrass component version
     * Add file privilege check before processing document state file
     * Storing AWS document interpolation ENV_VAR types as environment variables
     * Throw explicit error when running local cli as non-priviledged user
     * Harden telemetry dynamic config folder permissions
     * Add configuration option for HandshakeTimeout
     * Improve unit tests
     * Add setup for emitting telemetry logs and metrics
     * Add initial selection of error logs to emit to telemetry
     * Simplify checkstyle and import organization in build scripts
     * Update golang.org/x/net from v0.37.0 to v0.38.0
     * Agent hibernation reason is logged to EC2 system logs
     * Add metrics for the EC2Detector and IMDS EC2 status findings
     * Change Linux DomainJoin plugin parameter KeepHostName to accept        both boolean and string
     * Upgrade GoLang to version 1.23.8
     * Update golang.org/x/crypto from v0.32.0 to v0.36.0 (bsc#1239342, CVE-2025-22869)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2467-1 advisory.

    This update for amazon-ssm-agent fixes the following issues

    Update to version 3.3.4624.0:

    - CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of     golang.org/x/crypto/ssh       (bsc#1239342).
    - CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
    - CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected     message type in       response to a key listing or signing request (bsc#1253611).
    - CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for     specific inputs       (bsc#1265474).
    - CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack     and .idx files       can lead to the consumption of corrupted files (bsc#1258095).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege esca (bsc#1266781).
    - CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following     redirects during       smart-HTTP clone and fetch operations (bsc#1264952).
    - CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to     DoS via infinite       loops, panics or resource consumption (bsc#1267332).
    - CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
    - CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in     golang.org/x/crypto/ssh       (bsc#1266200).
    - CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in     golang.org/x/crypto/ssh       (bsc#1266200).
    - CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent       (bsc#1266200).
    - CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
    - CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
    - CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in     golang.org/x/crypto/ssh/knownhosts       (bsc#1266200).
    - CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in     golang.org/x/crypto/ssh       (bsc#1266200).
    - CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent     (bsc#1266200).

    Changes:

     * Bump golang.org/x/crypto from v0.51.0 to v0.52.0
     * Bump golang.org/x/net from v0.54.0 to v0.55.0
     * Enforce directory boundary in BuildSafePath
     * Fix visibility issue with Bottlerocket OS in document output
     * Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this        also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
     * Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
     * Quit if sysprep failed and log its current state
     * Remove attached legacy cloudwatch plugin packages
     * Upgrade Go version to 1.25.10
     * Use BuildSafePath wherever it is applicable
     * Add OOM killer protection to systemd service files
     * Apply more sanitation to file and registry inventory gatherers
     * Bump go-git to v5.17.1
     * Deprecate legacy cloudwatch plugin
     * Preserve network error details in credential refresher SSM API failures
     * Upgrade Go version to 1.25.9
     * Add SSM Distributor support for Bottlerocket OS
     * Implement flush credentials command in ssm-cli
     * Log ec2messages access denied as debug instead of error to reduce log noise
     * Make credential refresher refresh cache quickly in case of credential flush
     * Make Greengrass component registration resilient with retry
     * Add EnforceWorkspaceRootOwnership configuration to support disable        hardening of agent workspace
     * Add reboot comment to Windows shutdown command for SSM Agent traceability
     * Update privilege access check to verify ownership and permissions        of document state files
     * Add read-only version check prior to install and uninstall        in case of occupied package manager locks
     * Add ANSI processing for CloudWatch and S3 log
     * Upgrade go-git to v5.17.0 and cloudflare/circl to v1.6.3        to fix CVE-2026-1229
    - Switch to systemd-tmpfiles to store runtime data (jsc#PED-14843)
     * Disable Go 1.25 container-aware GOMAXPROCS to prevent holding        cgroup file descriptors open
     * Upgrade Go version to 1.25.8
     * Document CommandWorkerBufferLimit config
     * Include package update in Dockerfile
     * Reduce CloudWatch event message length threshold
     * Upgrade Go version to 1.25.7
     * Update github.com/go-git/go-git/v5 to 5.16.5 (bsc#1258095, CVE-2026-25934)
     * Update greengrass version
     * Update Golang version to 1.24.12
     * Updating golang.org/x/crypto from v0.37.0 to v0.47.0, golang.org/x/net        from v0.39.0 to v0.48.0 and golang.org/x/sys from v0.32.0 to v0.40.0        (bsc#1253611, CVE-2025-47913)
     * Categorize integration tests by adding new tags to split fast and slow ones
     * Fix bug where IP field being empty string and causing UII API failure
     * Allow Patch execution to persist across reboots not registered to SSM Agent
     * Fix ENV_VAR interpolation to work correctly with parameter store value
     * Implement immediate retries for failed reply messages to MGS for RunCommand documents
     * Improve ssm-cli get-diagnostics command log output
     * Support DomainJoin endpoint for EU sovereign cloud
     * Support dualstack S3 endpoint for distributor packages
     * Upgrade Go version to 1.24.11
     * Add initial IPv6 support with UseDualStackEndpoint configuration option
     * Fix CPU utilization issue for instances with thousands of network interfaces
     * Add IMDS retry count to account for EC2 droplet refresh
     * Fix duplicate uid error logging in MDS module
     * Update aws:Domainjoin plugin logging from Log4Net to NLog
     * Upgrade Go version to 1.24.7
     * Update github.com/go-git/go-git/v5 to 5.15.0
     * Update golang.org/x/crypto to v0.37.0 (bsc#1238702, CVE-2025-22870)
     * Update golang.org/x/net to v0.39.0
     * Update golang.org/x/sys to v0.32.0
     * Add EU sovereign cloud S3 endpoint for DownloadContent plugin
     * Add configurable credential rotation max backoff interval
     * Migrate from twinj/uuid to google/uuid library
     * Allow newer agent versions to be installed when deploying on Greengrass
     * Harden function to remove non-admin run command documents in execution path
     * Fix macOS credential refresher test issue due to missing Debugf from serialport skip file
     * Enhance testability of custom certificate usage in debug SSM Agent builds
     * Decouple serial port from startup and add credential refresher serialport logging
     * Add GlobalEnhancedTelemetryEnabled config to README
     * Add cloudwatch logs endpoint configuration to optional config for agent
     * Update Greengrass component version
     * Add file privilege check before processing document state file
     * Storing AWS document interpolation ENV_VAR types as environment variables
     * Throw explicit error when running local cli as non-priviledged user
     * Harden telemetry dynamic config folder permissions
     * Add configuration option for HandshakeTimeout
     * Improve unit tests
     * Add setup for emitting telemetry logs and metrics
     * Add initial selection of error logs to emit to telemetry
     * Simplify checkstyle and import organization in build scripts
     * Update golang.org/x/net from v0.37.0 to v0.38.0
     * Agent hibernation reason is logged to EC2 system logs
     * Add metrics for the EC2Detector and IMDS EC2 status findings
     * Change Linux DomainJoin plugin parameter KeepHostName to accept        both boolean and string
     * Upgrade GoLang to version 1.23.8
     * Update golang.org/x/crypto from v0.32.0 to v0.36.0 (bsc#1239342, CVE-2025-22869)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2438-1 advisory.

    This update for alloy fixes the following issues

    Security issues:

    - CVE-2026-4427: github.com/jackc/pgproto3/v2: improper validation of field length allows a malicious     PostgreSQL server       to crash a client application via a DataRow message (bsc#1259919).
    - CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack     and .idx files       can lead to the consumption of corrupted files (bsc#1258099).
    - CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce     invalid results       and lead to undefined behavior (bsc#1258609).
    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2:
    path pseudo-       header (bsc#1260317).
    - CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead     to a denial of       service (bsc#1262955).
    - CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32     integer overflow       (bsc#1263530).

    Non security issue:

    - Use systemd tmpfiles.d to create /var/lib/alloy hierarchy (jsc#PED-14815).
    - Update to version 1.16.1
     * Bug Fixes      logging: Fix startup deadlock when components log before      logging config is evaluated      Update to Beyla 3.9.8      Migrate from Docker to Moby
    - Use latest openSUSE Tumbleweed image for building web UI assets
    - Install nvm to set node version specified upstream
    - update to 1.16.0:
     * Features
     - Add clustering for loki.source.kubernetes_events (#6027)      (3dbf587) (@petewall)
     - Add otelcol.auth.google client auth provider (#5526)      (da99a66) (@dashpole, @clayton-cornell)
     - beyla.ebpf: Bump to v3.7.0 (#5966) (5126c2e) (@marctc)
     - database_observability: Add support for GCP Cloud SQL      metadata (#5875) (5d23245) (@cristiangreco, @clayton-cornell)
     - database_observability: Make targets optional (#5924)      (54664b2) (@matthewnolf)
     - database_observability: Update default excluded schemas and      users (#6080) (b386fff) (@cristiangreco)
     - faro.receiver: Add sourcemap fetching from remote locations      (#4614) (b6cb5da) (@Oxel40)
     - helm: Add support for global.image.pullPolicy (#6069)      (2e2ce72) (@petewall)
     - helm: Allow configuring image pull policy for config reloader      (#5923) (991539b) (@kalleep)
     - loki.secretfilter: Add label_timed_out option to mark      timed-out log lines (#5898) (2ad8834) (@kleimkuhler)
     - loki.secretfilter: Add secrets_redacted_by_category_total      metric combining rule and origin (#5855) (053a2f7)      (@kleimkuhler)
     - loki.secretfilter: Change secretfilter to use go-re2 regex      library instead of stdlib (#5909) (c16a660) (@mikefat)
     - loki.secretfilter: Remove redundant      secrets_redacted_by_rule_total and secrets_redacted_by_origin      metrics (#5970) (b16decb) (@kleimkuhler)
     - Oracle exporter can scrape more than one DB (#6008) (6fbad38)      (@ptodev)
     - prometheus.exporter.cloudwatch: Upgrade YACE and drop      aws-sdk-go v1 support (#5936) (f1c036d) (@x1unix)
     - prometheus.exporter.mysql: Update to mysqld_exporter 0.19.0      (#5836) (4f49b57) (@cristiangreco)
     - prometheus.remote_write: Sync WAL with upstream Prometheus      (#5907) (e74a91b) (@x1unix)
     - pyroscope: Add support for extra async-profiler CLI arguments      (#5472) (9251e33) (@ivanape)
     - pyroscope: Replace Parca gRPC debuginfo upload with Pyroscope      Connect API (#5891) (e7ea34a) (@korniltsev-grafanista)
     - pyroscope: Update debuginfo client for HTTP/1.1 upload API      (#6037) (879d8e5) (@korniltsev-grafanista)
     - Change service stop command from 'sc' to 'net' (#5906)      (450973d) (@mateuszdrab)
     - database_observability.mysql: Refactor explain plan loop      batch size (#5894) (f0fcd6b) (@cristiangreco)
     - database_observability.postgres: Cleanup embedded exporter      collectors on reconnection (#6079) (f30d9ae) (@cristiangreco)
     - database_observability.postgres: Fix EXPLAIN param count when      placeholders repeat (#6082) (b612b81) (@rgeyer)
     - database_observability: Drop schema_detection from logs      (#6076) (b0105cb) (@cristiangreco)
     - database_observability: Ensure connection_info_monitor      goroutine exits on Stop (#5874) (1e3334b) (@cristiangreco)
     - deps: Update module github.com/aws/aws-sdk-go-v2/service/s3      to v1.97.3 [SECURITY] (#6004) (38f4346)
     - deps: Update module github.com/go-git/go-git/v5 to v5.17.1      [SECURITY] (#5934) (a5154af)
     - deps: Update module github.com/go-git/go-git/v5 to v5.18.0      [SECURITY] (#6090) (0e59d64)
     - deps: Update module github.com/nwaples/rardecode/v2 to v2.2.0      [SECURITY] (b44d51a) (@jharvey10)
     - deps: Update module      go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp      to v1.43.0 [SECURITY] (#6016) (d92c5c0)      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp      to v1.43.0 [SECURITY] (#6017) (e655bbc)
     - deps: Update module go.opentelemetry.io/otel/sdk to v1.43.0      [SECURITY] (#6018) (94006e8)
     - deps: Update some minor go dep versions (#5896) (4ddd0ed)      (@jharvey10)
     - go: Update alloy builder image to Go 1.25.9 (#6012) (d2ae8b8)      (@x1unix)
     - go: Upgrade to Go 1.25.9 (#6019) (d777ed1) (@x1unix,      @kalleep)
     - Helm: RBAC template handles empty rule arrays (#4860)      (c9430e9) (@naptalie, @dehaansa, @kalleep)
     - loki.process: Eliminate per-stream goroutines in multiline      stage (#6036) (c089e2e) (@kgeckhart)
     - loki.process: Prevent stage.structured_metadata from adding      the same metadata several times (#5965) (0ec8a26) (@kalleep,      @thampiotr)
     - loki.process: Wrap template in a custom type and move      validation to syntax.Validator (#5910) (700dd7d) (@kalleep)
     - prometheus.exporter.postgres: Close DB connections on update      (#6021) (8da97cf) (@kalleep)
     - prometheus.scrape: Update scrape_native_histograms to be      updated at runtime (#6087) (18b205c) (@kalleep)
     - pyroscope.ebpf: Fix deadlock on LRU eviction in irsymcache      (#5911) (03ca563) (@luweglarz)
     - pyroscope.ebpf: Move Pyroscope ebpf metrics registration      after component error handling (#5540) (a3c57c0) (@crbednarz,      @marcsanmi)
     - pyroscope: Set user agent on debuginfo connect-go client      (#6022) (38ad1ef) (@korniltsev-grafanista)
     - ui: Large arguments are downloaded as files instead of      rendered (#5268) (26c67b3) (@ptodev)
     - Update go-m1cpu v0.1.7 -> v0.2.1 to fix M5 chip crash (#6034)      (7fa0cbc) (@ymotongpoo)
     - windows-installer: Increase service restart on failure delays      (#5969) (add15b1) (@rknightion)
    - add script to package webassets inside a podman container, to not      endanger or pollute the host system with npm
    - update to 1.15.1:
     goroutine exits on Stop
     * CVE-2026-34986: Fix panic in JWE decryption (bsc#1262955)
    - update to 1.15.0:
     * BREAKING CHANGES
     - otelcol: Upgrade to OTel Collector v0.147.0
     - Renamed undocumented metrics that was previously prefixed      with <component_id><metric_name> to      loki_source_awsfirehose<metric_name>
     * Security      CVE-2026-26958: Update filippo.io/edwards25519 to version 1.1.1      (bsc#1258609).
     - alloy-mixin: Add filters, groupBy, and multi-select dashboard      variables
     - beyla.ebpf: Add support for Prometheus native histograms
     - beyla.ebpf: Bump Beyla to v3.6
     - converters: Support converting Promtail limits_config
     - database_observability.mysql: Add filtering of query samples      and wait events by minimum duration
     - database_observability.mysql: Embed prometheus exporter      within db-o11y component
     - database_observability.postgres: Add configurable limit to      pg_stat_statements query
     - database_observability.postgres: Embed prometheus exporter
     - database_observability: Promote components to stable
     - Expose Functionality to Handle syslogs with Empty MSG Field
     - loki.process: Support structured metadata as source type of      stage.labels for loki.process
     - loki.secretfilter: Add sampling for secretfilter entries
     - loki.source.gcplog: Add alloy config for MaxOutstandingBytes      and MaxOutstandingMessages
     - loki.write: Add loki pipeline latency metric
     - mixin: Update loki dashboard
     - otelcol.receiver.datadog: Expose intake proxy and      trace_id_cache_size settings
     - prometheus.exporter.cloudwatch: Use aws-sdk-go-v2 by default
     - pyroscope.ebpf: Add comm, pid labels and kernel frame options
    - update to 1.14.1:
     - Correctly handle the deprecated topic field in      otelcol.receiver.kafka configuration
     - loki.process: Protect against json that does not look like      docker json format
     - loki.source.file: Keep positions for compressed files when      reading is finished
     - prometheus.scrape: Update arguments and targets even if      scrape_native_histograms and extra_metrics are updated
    - update to 1.14.0:
     - loki.secretfilter: Some config options are removed entirely:
     partial_mask (replaced with redact_percent), allowlist (now      controlled with custom gitleaks config), enable_entropy,      include_generic, types (now controlled with custom gitleaks      config).
     - otelcol.receiver.prometheus: otelcol.receiver.prometheus no      longer sets start times of OTLP metrics.
     * Security:
    - update to 1.13.2:
     - Expose missing otelcol.processor.tail_sampling options
     - mixin: Add zipped dashboards as a release artifact
     - profiler: Backport Go 1.26 gopclntab textStart fix
     - prometheus.exporter.postgres: Update version of the exporter      fork to fix pg_settings
     - pyroscope.ebpf: Backport dotnet nibble map fix
    - update to 1.13.1:
     - timeout before starting new ones
    - update to 1.13.0:
     - otelcol: Upgrade to OTel Collector v0.142.0
     - otelcol.receiver.kafka: The global topic attribute has been      deleted; use the topics attributes inside the logs, metrics,      and traces blocks instead.
     - otelcol.exporter > sending_queue > batch > min_size changed      from 8192 to 2000 and max_size changed from 0 to 3000
     - Add a virtual_node_peer_attributes and      virtual_node_extra_label arguments to      otelcol.connector.servicegraph
     - Add an otelcol.processor.metric_start_time component
     - Add job level period, length, and add_cloudwatch_timestamp      options and labels_snake_case to CW exporter
     - Add missing configuration parameter      deployment_name_from_replicaset to k8sattributes processor
     - Add parcas symbols upload to pyroscope.ebpf
     - Add sharding for loki.write
     - Add unexposed otel engine and extension to codebase and      change build structure
     - beyla.ebpf: Add meta_cache_address to      beyla.ebpf.attributes.kubernetes
     - beyla.ebpf: Upgrade Beyla to v2.8.5
     - Change the defaults for sending_queue > batch block inside      otelcol.exporter components
     - cluster: Support DNS discovery mode prefixes in
     --cluster.join-addresses flag
     - converter: Update promtail converter to use file_match block      for loki.source.file
     - database_observability: Add health check collector for      postgres component
     - database_observability: Expose exclude_schemas and      exclude_databases settings
     - database_observability: Support Azure cloud provider config      data
     - database_observability.mysql: Support excluding schemas in      all collectors
     - database_observability.postgres: Support excluding DBs in all      collectors

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20702-1 advisory.

    Changes in trivy:

    - Update to version 0.70.0 (          bsc#1260193, CVE-2026-33186,          bsc#1260971, CVE-2026-33747,          bsc#1261052, CVE-2026-33748,          bsc#1262389, CVE-2026-39984,          bsc#1262893, CVE-2026-34986):
      * release: v0.70.0 [main] (#10105)
      * chore(deps): bump go.opentelemetry.io/otel/sdk from 1.42.0 to 1.43.0 (#10496)
      * chore(deps): bump github.com/sigstore/timestamp-authority/v2 from 2.0.3 to 2.0.6 (#10526)
      * chore(deps): bump the common group across 1 directory with 8 updates (#10540)
      * chore(deps): bump the docker group across 1 directory with 2 updates (#10538)
      * fix: use Development category for GoReleaser discussions (#10530)
      * chore(deps): bump testcontainers-go to v0.42.0 (#10531)
      * chore: update CODEOWNERS (#10529)
      * chore(deps): bump helm.sh/helm/v3 from 3.20.1 to 3.20.2 (#10511)
      * chore(deps): bump github.com/hashicorp/go-getter from 1.8.5 to 1.8.6 (#10510)
      * chore(deps): bump github.com/moby/buildkit from 0.27.1 to 0.28.1 (#10449)
      * ci: migrate from mkdocs-material-insiders to mkdocs-material (#10509)
      * chore: remove aquasecurity/homebrew-trivy tap from GoReleaser (#10508)
      * ci: update runners for workflows that interact with GitHub API (#10502)
      * ci: rename tokens and update runners (#10500)
      * ci: trigger helm chart publishing via helm-charts workflow (#10474)
      * ci: remove ruleset update step from release-please workflow (#10499)
      * ci: use large runner and replace ORG_REPO_TOKEN in release-please workflow (#10498)
      * ci: trigger rpm/deb deployment via trivy-repo workflow (#10476)
      * fix: remove os.Stdout from wazero module config (#10403)
      * chore(deps): bump the common group across 1 directory with 22 updates (#10408)
      * chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 (#10407)
      * fix(flag): validate template file extension (#10296)
      * fix(sbom): preserve Red Hat BuildInfo when scanning SBOMs without layer info (#10378)
      * fix: handle Go 1.26 GOEXPERIMENT version format change (#10351)
      * fix(python): handle multiple version specifiers in requirements.txt (#10361)
      * ci: run Trivy version bump in trivy-action (#10272)
      * fix(python): nil pointer dereference with optional poetry groups without dependencies (#10359)
      * ci: replace personal email with github-actions[bot] in workflows (#10369)
      * chore: replace smithy epoch parsing with stdlib time.Unix (#10286)
      * test: update golden files for purl changes (#10372)
      * ci: add zizmor to scan GitHub Actions workflows (#10322)
      * refactor: log statuses as strings (#10285)
      * ci: add build provenance attestations for release artifacts (#10316)
      * fix(sbom): add NOASSERTION for licenseDeclared/licenseConcluded in SPDX non-library packages (#10368)
      * fix(report): set correct sarif ROOTPATH uri when scanning a git repository (#10366)
      * perf(plugin): optimize directory traversal by replacing filepath.Walk with filepath.WalkDir (#10325)
      * docs: correct typos in CHANGELOG and diagram (#10320)
      * chore: delete roadmap wf (#10295)
      * ci(helm): bump Trivy version to 0.69.3 for Trivy Helm Chart 0.21.3 (#10310)
      * fix(cyclonedx): include CVSS v4 vulnerability ratings (#10313)
      * fix: detected vulnerability fields in azure and mariner detector (#10275)
      * ci: add persist-credentials: false to checkout steps (#10306)
      * ci(helm): bump Trivy version to 0.69.2 for Trivy Helm Chart 0.21.2 (#10270)
      * chore(deps): bump the common group across 1 directory with 8 updates (#10248)
      * chore(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 (#10257)
      * chore(deps): bump the aws group across 1 directory with 6 updates (#10249)
      * chore(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 (#10241)
      * ci: remove apidiff workflow (#10259)
      * chore(deps): bump github.com/docker/cli from 29.1.4+incompatible to 29.2.1+incompatible in the docker     group across 1 directory (#10221)
      * ci: bump golangci-lint to v2.10 in cache-test-assets (#10243)
      * feat(java): add support for proxy configuration from Maven settings.xml (#10187)
      * chore(deps): bump the github-actions group across 3 directories with 11 updates (#10242)
      * feat(python): add pylock.toml support (#10137)
      * chore: bump SPDX license IDs and exceptions to `v3.28.0` (#10233)
      * docs: fix typos and upgrade insecure HTTP links to HTTPS (#10219)
      * chore: bump golangci-lint to v2.10.0 (#10223)
      * feat(misconf): support for azurerm_network_interface_security_group_association  (#10215)
      * ci: pin Docker Engine to v29 for integration tests (#10232)
      * feat(go): detect version from ELF symbol table for binaries built with -trimpath (#10197)
      * docs: migrate private registry documentation from GCR to GAR (#10208)
      * chore(deps): bump the common group across 1 directory with 24 updates (#10206)
      * chore(deps): update Docker client SDK to v29 (#10202)
      * test: update Docker Engine integration tests for Docker API v0.29.0+ compatibility (#10199)
      * fix(misconf): initialize custom annotation field if empty (#10123)
      * feat(ubuntu): add eol data for 25.10 (#10181)
      * docs: fix incorrect count of Python package managers (#10175)
      * chore(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to 5.16.5 (#10179)
      * feat(misconf): resolve Azure resources via resource_id (#10173)
      * ci(helm): bump Trivy version to 0.69.1 for Trivy Helm Chart 0.21.1 (#10155)
      * refactor: remove unused Insecure field from ServiceOption (#10113)
      * refactor: reduce complexity of init in detect.go (#10163)
      * feat(misconf): adapt ARM k8s clusters (#9696) (#10125)
      * docs: update version endpoint example in client/server documentation (#10151)
      * feat(vuln): skip third-party packages in common Detect function (#10129)
      * ci: add composite action for Go setup (#10146)
      * fix(misconf): apply check aliases when filtering results via .trivyignore (#10112)
      * docs(terraform): add limitation for data sources and computed resource attributes (#10128)
      * fix: update PhotonOS feed URL (#10122)
      * feat(server): include server version info in JSON output for client/server mode (#10075)
      * chore(deps): bump to alpine:3.23.3 and go-1.25.6 to fix CVEs (#10107)
      * refactor: unify scanner error limit and compiler limit (#10106)
      * ci(helm): bump Trivy version to 0.69.0 for Trivy Helm Chart 0.21.0 (#10103)
      * fix(java): Disable overwriting exclusions (#10088)
      * refactor(rust): use txtar format for cargo analyzer test data (#10104)
      * feat(python): add pylock.toml (PEP 751) parser (#9632)
      * chore(deps): bump the aws group across 1 directory with 6 updates (#10068)
      * fix(server): exclude JavaDB and CheckBundle from /version endpoint (#10100)

    - Update to version 0.69.3 (CVE-2026-25934, bsc#1258094):
      * release: v0.69.3 [release/v0.69] (#10293)
      * fix(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to 5.16.5 [backport: release/v0.69] (#10291)
      * release: v0.69.2 [release/v0.69] (#10266)
      * fix(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 [backport: release/v0.69] (#10267)
      * fix(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 [backport: release/v0.69] (#10264)
      * ci: remove apidiff workflow
      * release: v0.69.1 [release/v0.69] (#10145)
      * ci: add composite action for Go setup [backport: release/v0.69] (#10150)
      * fix(misconf): apply check aliases when filtering results via .trivyignore [backport: release/v0.69]     (#10143)
      * chore(deps): bump to alpine:3.23.3 and go-1.25.6 to fix CVEs [backport: release/v0.69] (#10135)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1411-1 advisory.

    This update for terraform-provider-local, terraform-provider-random, terraform-provider-tls fixes the     following issue:

    - CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack     and .idx files that can lead to the consumption of corrupted files (bsc#1258097).
    - CVE-2026-33186: fix authorization bypass in grpc-go due to improper validation of the HTTP/2 :path     pseudo-header (bsc#1260218)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8088-1 advisory.

    Ionut Lalu discovered that go-git incorrectly handled certain specially crafted Git server responses. An     attacker could possibly use this issue to cause a denial of service. (CVE-2023-49568, CVE-2025-21614)

    Ionut Lalu discovered that go-git incorrectly handled file system paths when using the ChrootOS     implementation. A remote attacker could possibly use this issue to perform a path traversal and create or     modify arbitrary files, leading to remote code execution. (CVE-2023-49569)

    It was discovered that go-git did not properly sanitize arguments when invoking git-upload-pack using the     file transport protocol. An attacker could possibly use this issue to inject arbitrary flag values when     interacting with local Git repositories. (CVE-2025-21613)

    It was discovered that go-git did not properly verify integrity checks for pack and index files. An     attacker could possibly use this issue to cause go-git to process corrupted repository data, resulting in     unexpected errors or an incorrect repository state. (CVE-2026-25934)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a
    vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not
    properly verified. This resulted in go-git potentially consuming corrupted files, which would likely
    result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream
    Git servers. Those files contain a checksum of their contents, so that clients can perform integrity
    checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when
    new .pack files are received and processed. The integrity checks for both files were not being verified
    correctly. This vulnerability is fixed in 5.16.5. (CVE-2026-25934)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a     vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not     properly verified. This resulted in go-git potentially consuming corrupted files, which would likely     result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream     Git servers. Those files contain a checksum of their contents, so that clients can perform integrity     checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when     new .pack files are received and processed. The integrity checks for both files were not being verified     correctly. This vulnerability is fixed in 5.16.5. (CVE-2026-25934)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
321922	SUSE SLES12 Security Update : amazon-ssm-agent (SUSE-SU-2026:2468-1)	Nessus	SuSE Local Security Checks	medium
321917	SUSE SLES15 Security Update : amazon-ssm-agent (SUSE-SU-2026:2467-1)	Nessus	SuSE Local Security Checks	medium
321596	SUSE SLED15 / SLES15 Security Update : alloy (SUSE-SU-2026:2438-1)	Nessus	SuSE Local Security Checks	medium
313632	openSUSE 16 Security Update : trivy (openSUSE-SU-2026:20702-1)	Nessus	SuSE Local Security Checks	high
306872	SUSE SLES15: terraform-provider-local / terraform-provider-null / etc (SUSE-SU-2026:1411-1)	Nessus	SuSE Local Security Checks	medium
302212	Ubuntu 22.04 LTS / 24.04 LTS : go-git vulnerabilities (USN-8088-1)	Nessus	Ubuntu Local Security Checks	critical
437654	SCA: security update for github.com/go-git/go-git/v5 (GHSA-37cx-329c-33x3)	Tenable Cloud Security	SCA Checks	medium
437654	SCA: security update for github.com/go-git/go-git/v5 (GHSA-37cx-329c-33x3)	Tenable Self-Hosted Container Security	SCA Checks	medium
298456	Linux Distros Unpatched Vulnerability : CVE-2026-25934	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-25934

medium

Tenable Plugins

medium

medium

medium

high

medium

critical

medium

medium

medium