The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0172 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2026-4427:
    No description is available for this CVE.

    CVE-2025-61726:
    The net/url package does not set a limit on the number of query parameters in a query. While the maximum     size of query parameters in URLs is generally limited by the maximum request header size, the     net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many     unique query parameters can cause excessive memory consumption.

    CVE-2025-61728:
    archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an     archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP     archive.

    CVE-2025-68121:
    During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields     mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it     should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or     uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would     not have resumed with during the initial handshake, or cause a server to resume a session with a client     that it would not have resumed with during the initial handshake.

    CVE-2026-25679:
    url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

    CVE-2026-27137:
    When verifying a certificate chain which contains a certificate containing multiple email address     constraints which share common local portions but different domain portions, these constraints will not be     properly applied, and only the last constraint will be considered.

    CVE-2026-32282:
    On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress,     Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux     fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink     traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink     lying outside the root, so the impact is limited to cases where the target is replaced with a symlink     between the check and operation.

    CVE-2026-32283:
    If one side of the TLS connection sends multiple key update messages post-handshake in a single record,     the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of     service. This only affects TLS 1.3.

    CVE-2026-32286:
    The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised     PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of     range panic.

    CVE-2026-33186:
    gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass     resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too     lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash     (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests     to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated     the raw, non-canonical path string. Consequently, deny rules defined using canonical paths (starting     with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback allow     rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the     official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on     `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific deny rules     for canonical paths but allows other requests by default (a fallback allow rule). The vulnerability is     exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the     gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a     leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching     authorization interceptors or handlers with a non-canonical path string. While upgrading is the most     secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use     a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy     hardening.

    CVE-2026-34986:
    Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go,     including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT)     standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg     field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW,     and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in     key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the     encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() /     ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take     a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping     algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by     calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling     this function directly is less common. Panics can lead to denial of service. This vulnerability is fixed     in 4.1.4 and 3.0.5.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:22714 advisory.

    * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip     (CVE-2025-61728)

    * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

    * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

    * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

    * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    * github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message     (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)

    * google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to     improper HTTP/2 path validation (CVE-2026-33186)

    * github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL     server (CVE-2026-32286)

    * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted     JSON Web Encryption (JWE) object (CVE-2026-34986)

    * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

    * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages     (CVE-2026-32283)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:22714 advisory.

    A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild     under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It     is compatible with composer-cli and cockpit-composer clients.

    Security Fix(es):

    * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip     (CVE-2025-61728)

    * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

    * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

    * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

    * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    * github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message     (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)

    * google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to     improper HTTP/2 path validation (CVE-2026-33186)

    * github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL     server (CVE-2026-32286)

    * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted     JSON Web Encryption (JWE) object (CVE-2026-34986)

    * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

    * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages     (CVE-2026-32283)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:22450 advisory.

    A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild     under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It     is compatible with composer-cli and cockpit-composer clients.

    Security Fix(es):

    * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip     (CVE-2025-61728)

    * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

    * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

    * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

    * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    * github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message     (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)

    * google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to     improper HTTP/2 path validation (CVE-2026-33186)

    * github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL     server (CVE-2026-32286)

    * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted     JSON Web Encryption (JWE) object (CVE-2026-34986)

    * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

    * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages     (CVE-2026-32283)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:22450 advisory.

    * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip     (CVE-2025-61728)

    * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

    * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

    * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

    * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    * github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message     (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)

    * google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to     improper HTTP/2 path validation (CVE-2026-33186)

    * github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL     server (CVE-2026-32286)

    * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted     JSON Web Encryption (JWE) object (CVE-2026-34986)

    * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

    * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages     (CVE-2026-32283)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised     PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of     range panic. (CVE-2026-32286)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
324089	Alibaba Cloud Linux 3 : 0172: osbuild-composer (ALINUX3-SA-2026:0172)	Nessus	Alibaba Cloud Linux Local Security Checks	critical
320605	RockyLinux 9 : osbuild-composer (RLSA-2026:22714)	Nessus	Rocky Linux Local Security Checks	critical
319567	RHEL 9 : osbuild-composer (RHSA-2026:22714)	Nessus	Red Hat Local Security Checks	critical
319504	RHEL 10 : osbuild-composer (RHSA-2026:22450)	Nessus	Red Hat Local Security Checks	critical
318817	RockyLinux 10 : osbuild-composer (RLSA-2026:22450)	Nessus	Rocky Linux Local Security Checks	critical
304107	Linux Distros Unpatched Vulnerability : CVE-2026-32286	Nessus	Misc.	high

Detections

Analytics

CVE-2026-32286

high

Tenable Plugins

critical

critical

critical

critical

critical

high