(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1876 advisory.

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject     Alternative Name (SAN) entries. This caused strings.Split(host, .) to execute repeatedly on the same     input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of     SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before     building the certificate chain, this overhead occurred even for untrusted certificates. (CVE-2026-27145)

    Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive     CPU. (CVE-2026-42504)

    When returning errors, functions in the net/textproto package would include its input as part of the     error. This might allow an attacker to inject misleading content to errors that are printed or logged.
    (CVE-2026-42507)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1885 advisory.

    Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
    (CVE-2026-25680)

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can     be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
    (CVE-2026-25681)

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can     be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
    (CVE-2026-27136)

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject     Alternative Name (SAN) entries. This caused strings.Split(host, .) to execute repeatedly on the same     input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of     SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before     building the certificate chain, this overhead occurred even for untrusted certificates. (CVE-2026-27145)

    The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-     only label. For example, ToUnicode(xn--example-.com) incorrectly returns the name example.com rather     than an error. This behavior can lead to privilege escalation in programs using the idna package. For     example, a program which performs privilege checks on the ASCII hostname may reject example.com but     permit xn--example-.com. If that program subsequently converts the ASCII hostname to Unicode, it will     inadvertently permits access to the Unicode name example.com. (CVE-2026-39821)

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can     be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
    (CVE-2026-42502)

    Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive     CPU. (CVE-2026-42504)

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can     be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
    (CVE-2026-42506)

    When returning errors, functions in the net/textproto package would include its input as part of the     error. This might allow an attacker to inject misleading content to errors that are printed or logged.
    (CVE-2026-42507)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1884 advisory.

    Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
    (CVE-2026-25680)

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can     be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
    (CVE-2026-25681)

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can     be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
    (CVE-2026-27136)

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject     Alternative Name (SAN) entries. This caused strings.Split(host, .) to execute repeatedly on the same     input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of     SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before     building the certificate chain, this overhead occurred even for untrusted certificates. (CVE-2026-27145)

    The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-     only label. For example, ToUnicode(xn--example-.com) incorrectly returns the name example.com rather     than an error. This behavior can lead to privilege escalation in programs using the idna package. For     example, a program which performs privilege checks on the ASCII hostname may reject example.com but     permit xn--example-.com. If that program subsequently converts the ASCII hostname to Unicode, it will     inadvertently permits access to the Unicode name example.com. (CVE-2026-39821)

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can     be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
    (CVE-2026-42502)

    Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive     CPU. (CVE-2026-42504)

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can     be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
    (CVE-2026-42506)

    When returning errors, functions in the net/textproto package would include its input as part of the     error. This might allow an attacker to inject misleading content to errors that are printed or logged.
    (CVE-2026-42507)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1877 advisory.

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject     Alternative Name (SAN) entries. This caused strings.Split(host, .) to execute repeatedly on the same     input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of     SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before     building the certificate chain, this overhead occurred even for untrusted certificates. (CVE-2026-27145)

    Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive     CPU. (CVE-2026-42504)

    When returning errors, functions in the net/textproto package would include its input as part of the     error. This might allow an attacker to inject misleading content to errors that are printed or logged.
    (CVE-2026-42507)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of golang installed on the remote host is prior to 1.25.11-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3383 advisory.

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject     Alternative Name (SAN) entries. This caused strings.Split(host, .) to execute repeatedly on the same     input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of     SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before     building the certificate chain, this overhead occurred even for untrusted certificates. (CVE-2026-27145)

    Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive     CPU. (CVE-2026-42504)

    When returning errors, functions in the net/textproto package would include its input as part of the     error. This might allow an attacker to inject misleading content to errors that are printed or logged.
    (CVE-2026-42507)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1875 advisory.

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject     Alternative Name (SAN) entries. This caused strings.Split(host, .) to execute repeatedly on the same     input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of     SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before     building the certificate chain, this overhead occurred even for untrusted certificates. (CVE-2026-27145)

    Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive     CPU. (CVE-2026-42504)

    When returning errors, functions in the net/textproto package would include its input as part of the     error. This might allow an attacker to inject misleading content to errors that are printed or logged.
    (CVE-2026-42507)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of golist installed on the remote host is prior to 0.10.1-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3382 advisory.

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject     Alternative Name (SAN) entries. This caused strings.Split(host, .) to execute repeatedly on the same     input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of     SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before     building the certificate chain, this overhead occurred even for untrusted certificates. (CVE-2026-27145)

    Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive     CPU. (CVE-2026-42504)

    When returning errors, functions in the net/textproto package would include its input as part of the     error. This might allow an attacker to inject misleading content to errors that are printed or logged.
    (CVE-2026-42507)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of soci-snapshotter installed on the remote host is prior to 0.14.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-131 advisory.

    Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
    (CVE-2026-25680)

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can     be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
    (CVE-2026-25681)

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can     be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
    (CVE-2026-27136)

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject     Alternative Name (SAN) entries. This caused strings.Split(host, .) to execute repeatedly on the same     input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of     SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before     building the certificate chain, this overhead occurred even for untrusted certificates. (CVE-2026-27145)

    The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-     only label. For example, ToUnicode(xn--example-.com) incorrectly returns the name example.com rather     than an error. This behavior can lead to privilege escalation in programs using the idna package. For     example, a program which performs privilege checks on the ASCII hostname may reject example.com but     permit xn--example-.com. If that program subsequently converts the ASCII hostname to Unicode, it will     inadvertently permits access to the Unicode name example.com. (CVE-2026-39821)

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can     be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
    (CVE-2026-42502)

    Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive     CPU. (CVE-2026-42504)

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can     be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
    (CVE-2026-42506)

    When returning errors, functions in the net/textproto package would include its input as part of the     error. This might allow an attacker to inject misleading content to errors that are printed or logged.
    (CVE-2026-42507)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1878 advisory.

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject     Alternative Name (SAN) entries. This caused strings.Split(host, .) to execute repeatedly on the same     input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of     SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before     building the certificate chain, this overhead occurred even for untrusted certificates. (CVE-2026-27145)

    Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive     CPU. (CVE-2026-42504)

    When returning errors, functions in the net/textproto package would include its input as part of the     error. This might allow an attacker to inject misleading content to errors that are printed or logged.
    (CVE-2026-42507)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1874 advisory.

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject     Alternative Name (SAN) entries. This caused strings.Split(host, .) to execute repeatedly on the same     input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of     SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before     building the certificate chain, this overhead occurred even for untrusted certificates. (CVE-2026-27145)

    Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive     CPU. (CVE-2026-42504)

    When returning errors, functions in the net/textproto package would include its input as part of the     error. This might allow an attacker to inject misleading content to errors that are printed or logged.
    (CVE-2026-42507)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2327-1 advisory.

    This update for go1.26 fixes the following issues

    Update to go1.26.4 (bsc#1255111):

    - CVE-2026-27145: crypto/x509: split candidate hostname only once (bsc#1267450).
    - CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader (bsc#1267442).
    - CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping     (bsc#1267444).

    Changes:

     * go#79230 go#79217 boo#1267442 security: fix CVE-2026-42504 mime: quadratic complexity in     WordDecoder.DecodeHeader
     * go#79426 go#79346 boo#1267444 security: fix CVE-2026-42507 net/textproto: arbitrary input are included     in errors        without any escaping
     * go#79701 go#79694 boo#1267450 security: fix CVE-2026-27145 crypto/x509: split candidate hostname only     once
     * go#79191 cmd/compile: Bug in rewrite rules for AMD64 causes SHL instruction overflow and miscompilation
     * go#79226 crypto/internal/fips140/drbg: backport CL 774221 to Go 1.26
     * go#79349 cmd/fix: x/tools/go/analysis/passes/modernize: slicescontains hoists needle expression,     changing side        effect count
     * go#79686 runtime/race: change in 93a4f03 leads to a failed build on Amazon Linux 2 and arm64

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2326-1 advisory.

    This update for go1.25 fixes the following issues

    Update to go1.25.11 (bsc#1244485):

    - CVE-2026-27145: crypto/x509: split candidate hostname only once (bsc#1267450).
    - CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader (bsc#1267442).
    - CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping     (bsc#1267444).

    Changes:

     * go#79229 go#79217 boo#1267442 security: fix CVE-2026-42504 mime: quadratic complexity in     WordDecoder.DecodeHeader
     * go#79425 go#79346 boo#1267444 security: fix CVE-2026-42507 net/textproto: arbitrary input are included     in errors        without any escaping
     * go#79700 go#79694 boo#1267450 security: fix CVE-2026-27145 crypto/x509: split candidate hostname only     once
     * go#79190 cmd/compile: Bug in rewrite rules for AMD64 causes SHL instruction overflow and miscompilation
     * go#79698 runtime/race: change in 93a4f03 leads to a failed build on Amazon Linux 2 and arm64

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Golang running on the remote host is 1.25.x prior to 1.25.11, or 1.26.x prior to 1.26.4. It is, therefore, affected by multiple vulnerabilities:

  - (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative     Name (SAN) entries. This caused strings.Split to execute repeatedly on the same input hostname. With a large DNS     SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's     label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred     even for untrusted certificates. (CVE-2026-27145)

  - Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
    (CVE-2026-42504)

  - When returning errors, functions in the net/textproto package would include its input as part of the error. This     might allow an attacker to inject misleading content to errors that are printed or logged.
    (CVE-2026-42507)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject     Alternative Name (SAN) entries. This caused strings.Split(host, .) to execute repeatedly on the same     input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of     SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before     building the certificate chain, this overhead occurred even for untrusted certificates. (CVE-2026-27145)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
322112	Amazon Linux 2023 : golang-github-burntsushi-toml-test, golang-github-burntsushi-toml-test-devel (ALAS2023-2026-1876)	Nessus	Amazon Linux Local Security Checks	medium
322109	Amazon Linux 2023 : credentials-fetcher (ALAS2023-2026-1885)	Nessus	Amazon Linux Local Security Checks	critical
322102	Amazon Linux 2023 : soci-snapshotter (ALAS2023-2026-1884)	Nessus	Amazon Linux Local Security Checks	critical
322093	Amazon Linux 2023 : golang-github-burntsushi-toml, golang-github-burntsushi-toml-devel (ALAS2023-2026-1877)	Nessus	Amazon Linux Local Security Checks	medium
322074	Amazon Linux 2 : golang, --advisory ALAS2-2026-3383 (ALAS-2026-3383)	Nessus	Amazon Linux Local Security Checks	medium
322040	Amazon Linux 2023 : compat-golang-github-cpuguy83-md2man-2-devel, golang-github-cpuguy83-md2man, golang-github-cpuguy83-md2man-devel (ALAS2023-2026-1875)	Nessus	Amazon Linux Local Security Checks	medium
322028	Amazon Linux 2 : golist, --advisory ALAS2-2026-3382 (ALAS-2026-3382)	Nessus	Amazon Linux Local Security Checks	medium
322017	Amazon Linux 2 : soci-snapshotter, --advisory ALAS2DOCKER-2026-131 (ALASDOCKER-2026-131)	Nessus	Amazon Linux Local Security Checks	critical
322011	Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2026-1878)	Nessus	Amazon Linux Local Security Checks	medium
321993	Amazon Linux 2023 : golist (ALAS2023-2026-1874)	Nessus	Amazon Linux Local Security Checks	medium
321018	SUSE SLED15 / SLES15 Security Update : go1.26 (SUSE-SU-2026:2327-1)	Nessus	SuSE Local Security Checks	medium
320995	SUSE SLED15 / SLES15 Security Update : go1.25 (SUSE-SU-2026:2326-1)	Nessus	SuSE Local Security Checks	medium
318618	Golang 1.25.x < 1.25.11 / 1.26.x < 1.26.4 Multiple Vulnerabilities	Nessus	Misc.	medium
318379	Linux Distros Unpatched Vulnerability : CVE-2026-27145	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-27145

medium

Tenable Plugins

medium

critical

critical

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium