On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.

oracle_linux ELSA-2026-11711: ELSA-2026-11711:  grafana security update (IMPORTANT)

oracle_linux ELSA-2026-11704: ELSA-2026-11704:  grafana-pcp security update (IMPORTANT)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-10704 advisory.

    delve     [1.25.2-1.0.1]
    - Disable DWARF compression which has issues (Alex Burmashev)

    [1.25.2-1]
    - Update to Delve 1.25.2 (Sync from CentOS Stream 9)
    - Related: RHEL-121223

    golang     [1.25.9-1]
    - Update to Go 1.25.9 (fips-2)
    - Resolves: RHEL-169932

    [1.25.7-2]
    - Update to Go 1.25.8 (fips-1)
    - Resolves: RHEL-156551

    [1.25.7-1]
    - Update to Go 1.25.7 (fips-1)
    - Resolves: RHEL-146469

    [1.25.5-1]
    - Update to Go 1.25.5 (fips-1)
    - Resolves: RHEL-139365

    [1.25.3-1]
    - Update to Go 1.25.3 (sync from CentOS Stream 9)
    - Build go-toolset as a subpackage
    - Preserve GOAMD64=v1 for RHEL 8
    - Resolves: RHEL-121223

    [1.24.6-1]
    - Update to Go 1.24.6 (fips-1)
    - Resolves: RHEL-106455

    [1.24.4-1]
    - Update to Go 1.24.4 (fips-1)
    - Resolves: RHEL-85264

    [1.23.9-1]
    - Update to Go 1.23.9
    - Resolves: RHEL-94636

    [1.23.6-1]
    - Update to Go 1.23.6
    - Resolves: RHEL-83824

    [1.22.11-1]
    - Rebase to Go1.22.11 to pick up fixes for CVE 2024-45341 and 2024-45336
    - Fix test failures with expired certificates
    - Resolves: RHEL-73752

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1580-1 advisory.

    - Update to go1.26.2 (bsc#1255111).
    - CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG (bsc#1261653).
    - CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination (bsc#1261654).
    - CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking (bsc#1261655).
    - CVE-2026-32280: crypto/x509: unexpected work during chain building (bsc#1261656).
    - CVE-2026-32281: crypto/x509: inefficient policy validation (bsc#1261657).
    - CVE-2026-32282: os: Root.Chmod can follow symlinks out of the root on Linux (bsc#1261658).
    - CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock     (bsc#1261659).
    - CVE-2026-32288: archive/tar: unbounded allocation when parsing old format GNU sparse map (bsc#1261660).
    - CVE-2026-32289: html/template: JS template literal context incorrectly tracked (bsc#1261661).
    - CVE-2026-33810: crypto/x509: excluded DNS constraints not properly applied to wildcard domains     (bsc#1261662).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1581-1 advisory.

    - Update to go1.25.9 (bsc#1244485).
    - CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG (bsc#1261653).
    - CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination (bsc#1261654).
    - CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking (bsc#1261655).
    - CVE-2026-32280: crypto/x509: unexpected work during chain building (bsc#1261656).
    - CVE-2026-32281: crypto/x509: inefficient policy validation (bsc#1261657).
    - CVE-2026-32282: os: Root.Chmod can follow symlinks out of the root on Linux (bsc#1261658).
    - CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock     (bsc#1261659).
    - CVE-2026-32288: archive/tar: unbounded allocation when parsing old format GNU sparse map (bsc#1261660).
    - CVE-2026-32289: html/template: JS template literal context incorrectly tracked (bsc#1261661).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-10219 advisory.

    [1.25.9-1]
    - Update to Go 1.25.9 (fips-2)
    - Resolves: RHEL-169931

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-10217 advisory.

    [1.25.9-3]
    - Do not ignore any tests in check

    [1.25.9-2]
    - Skip terminal test in container

    [1.25.9-1]
    - Update to Go 1.25.9 (fips-2)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20570-1 advisory.

    - Update to version go1.25.9 (bsc#1244485).
    - CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG (bsc#1261653).
    - CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination (bsc#1261654).
    - CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking (bsc#1261655).
    - CVE-2026-32280: crypto/x509: unexpected work during chain building (bsc#1261656).
    - CVE-2026-32281: crypto/x509: inefficient policy validation (bsc#1261657).
    - CVE-2026-32282: os: Root.Chmod can follow symlinks out of the root on Linux (bsc#1261658).
    - CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock     (bsc#1261659).
    - CVE-2026-32288: archive/tar: unbounded allocation when parsing old format GNU sparse map (bsc#1261660).
    - CVE-2026-32289: html/template: JS template literal context incorrectly tracked (bsc#1261661).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20571-1 advisory.

    - Update to version go1.26.2 (bsc#1255111).
    - CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG (bsc#1261653).
    - CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination (bsc#1261654).
    - CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking (bsc#1261655).
    - CVE-2026-32280: crypto/x509: unexpected work during chain building (bsc#1261656).
    - CVE-2026-32281: crypto/x509: inefficient policy validation (bsc#1261657).
    - CVE-2026-32282: os: Root.Chmod can follow symlinks out of the root on Linux (bsc#1261658).
    - CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock     (bsc#1261659).
    - CVE-2026-32288: archive/tar: unbounded allocation when parsing old format GNU sparse map (bsc#1261660).
    - CVE-2026-32289: html/template: JS template literal context incorrectly tracked (bsc#1261661).
    - CVE-2026-33810: crypto/x509: excluded DNS constraints not properly applied to wildcard domains     (bsc#1261662).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1320-1 advisory.

    - Update to go1.26.2 (bsc#1255111).
    - CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG (bsc#1261653).
    - CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination (bsc#1261654).
    - CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking (bsc#1261655).
    - CVE-2026-32280: crypto/x509: unexpected work during chain building (bsc#1261656).
    - CVE-2026-32281: crypto/x509: inefficient policy validation (bsc#1261657).
    - CVE-2026-32282: os: Root.Chmod can follow symlinks out of the root on Linux (bsc#1261658).
    - CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock     (bsc#1261659).
    - CVE-2026-32288: archive/tar: unbounded allocation when parsing old format GNU sparse map (bsc#1261660).
    - CVE-2026-32289: html/template: JS template literal context incorrectly tracked (bsc#1261661).
    - CVE-2026-33810: crypto/x509: excluded DNS constraints not properly applied to wildcard domains     (bsc#1261662).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1321-1 advisory.

    - Update to go1.25.9 (bsc#1244485).
    - CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG (bsc#1261653).
    - CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination (bsc#1261654).
    - CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking (bsc#1261655).
    - CVE-2026-32280: crypto/x509: unexpected work during chain building (bsc#1261656).
    - CVE-2026-32281: crypto/x509: inefficient policy validation (bsc#1261657).
    - CVE-2026-32282: os: Root.Chmod can follow symlinks out of the root on Linux (bsc#1261658).
    - CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock     (bsc#1261659).
    - CVE-2026-32288: archive/tar: unbounded allocation when parsing old format GNU sparse map (bsc#1261660).
    - CVE-2026-32289: html/template: JS template literal context incorrectly tracked (bsc#1261661).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Golang running on the remote host is 1.25.x prior to 1.25.9, or 1.26.x prior to 1.26.2. It is, therefore, affected by multiple vulnerabilities, including:

  - Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the     compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.
    (CVE-2026-27143)

  - SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code     execution at build time due to trust layer bypass. (CVE-2026-27140)

  - The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion     prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to     memory corruption at runtime. (CVE-2026-27144)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress,     Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux     fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink     traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink     lying outside the root, so the impact is limited to cases where the target is replaced with a symlink     between the check and operation. (CVE-2026-32282)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
310729	Oracle Linux 8 : go-toolset:ol8 (ELSA-2026-10704)	Nessus	Oracle Linux Local Security Checks	critical
310239	SUSE SLES15 Security Update : go1.26-openssl (SUSE-SU-2026:1580-1)	Nessus	SuSE Local Security Checks	critical
310227	SUSE SLES15 Security Update : go1.25-openssl (SUSE-SU-2026:1581-1)	Nessus	SuSE Local Security Checks	critical
310152	Oracle Linux 9 : golang (ELSA-2026-10219)	Nessus	Oracle Linux Local Security Checks	critical
310133	Oracle Linux 10 : golang (ELSA-2026-10217)	Nessus	Oracle Linux Local Security Checks	critical
309154	openSUSE 16 Security Update : go1.25 (openSUSE-SU-2026:20570-1)	Nessus	SuSE Local Security Checks	critical
309134	openSUSE 16 Security Update : go1.26 (openSUSE-SU-2026:20571-1)	Nessus	SuSE Local Security Checks	critical
306493	SUSE SLED15 / SLES15 Security Update : go1.26 (SUSE-SU-2026:1320-1)	Nessus	SuSE Local Security Checks	critical
306482	SUSE SLED15 / SLES15 Security Update : go1.25 (SUSE-SU-2026:1321-1)	Nessus	SuSE Local Security Checks	critical
305686	Golang 1.25.x < 1.25.9 / 1.26.x < 1.26.2 Multiple Vulnerabilities	Nessus	Misc.	critical
305649	Linux Distros Unpatched Vulnerability : CVE-2026-32282	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-32282

medium

Tenable Plugins

Coming Soon

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

medium