The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21254-1 advisory.

    Update to go1.26.4  (bsc#1255111).

    Security issues fixed:

    - CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG (bsc#1261653).
    - CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination (bsc#1261654).
    - CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking (bsc#1261655).
    - CVE-2026-27145: crypto/x509: split candidate hostname only once (bsc#1267450).
    - CVE-2026-32280: crypto/x509: unexpected work during chain building (bsc#1261656).
    - CVE-2026-32281: crypto/x509: inefficient policy validation (bsc#1261657).
    - CVE-2026-32282: os: `Root.Chmod` can follow symlinks out of the root on Linux (bsc#1261658).
    - CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock     (bsc#1261659).
    - CVE-2026-32288: archive/tar: unbounded allocation when parsing old format GNU sparse map (bsc#1261660).
    - CVE-2026-32289: html/template: JS template literal context incorrectly tracked (bsc#1261661).
    - CVE-2026-33810: crypto/x509: excluded DNS constraints not properly applied to wildcard domains     (bsc#1261662).
    - CVE-2026-33811: net: crash when handling long `CNAME` response (bsc#1264508).
    - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad `SETTINGS_MAX_FRAME_SIZE`     (bsc#1264506).
    - CVE-2026-39817: cmd/go: `go tool pack` does not sanitize output paths (bsc#1264505).
    - CVE-2026-39819: cmd/go: `go bug` follows symlinks in predictable temporary filenames (bsc#1264504).
    - CVE-2026-39820: net/mail: quadratic string concatentation in `consumeComment` (bsc#1264503).
    - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
    - CVE-2026-39825: net/http/httputil: `ReverseProxy` forwards queries with more than `urlmaxqueryparams`     parameters       (bsc#1264500).
    - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
    - CVE-2026-39836: net: panic in `Dial` and `LookupPort` when handling `NUL` byte on Windows (bsc#1264501).
    - CVE-2026-42499: net/mail: quadratic string concatenation in `consumePhrase` (bsc#1264502).
    - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).
    - CVE-2026-42504: mime: quadratic complexity in `WordDecoder.DecodeHeader` (bsc#1267442).
    - CVE-2026-42507: net/textproto: arbitrary input is included in errors without any escaping (bsc#1267444).

    Other updates and security fixes:

    - Go packages miss `binutils-gold` dependency (bsc#1170826).
    - Drop subpackage `go1.x-libstd` `std` library `.so` refs (jsc#PED-1962).
    - Use `libalternatives` only on `suse_version >= 1610` and keep `update-alternatives` support for older       distributions.
    - Drop the `update-alternatives` migration path for `libalternatives` builds.
    - Enable `libalternatives` for SLE16.1 and Tumbleweed (bsc#1245878).
    - Drop go1.26 dependency on `update-alternatives` (bsc#1264395)
    - Update to version 1.26.3 cut from the `go1.25-fips-release` branch at the revision tagged     `go1.26.3-1-openssl-fips`       (jsc#SLE-18320).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-22121 advisory.

    [1.26.3-1.0.1]
    - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var

    [1.26.3-1]
    - Update to Go 1.26.3 (fips-1)
    - Resolves: RHEL-175607

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the go package has been released.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-22112 advisory.

    delve     [1.25.2-1.0.1]     golang     [1.25.9-1.0.1]
    - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var
    - Backported from OL9u7
    - Resolves: OLDIS-53586

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2079-1 advisory.

    This update for go1.25-openssl fixes the following issues

    Security issues:

    - CVE-2026-33811: net: crash when handling long CNAME response (bsc#1264508).
    - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE     (bsc#1264506).
    - CVE-2026-39817: cmd/go: 'go tool pack' does not sanitize output paths (bsc#1264505).
    - CVE-2026-39819: cmd/go: 'go bug' follows symlinks in predictable temporary filenames (bsc#1264504).
    - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment (bsc#1264503).
    - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
    - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams     parameters       (bsc#1264500).
    - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
    - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows (bsc#1264501).
    - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase (bsc#1264502).
    - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).

    Non security issues:

    - go1.25 release tracking (bsc#1244485).
    - Go packages miss binutils-gold dependency (bsc#1170826).
    - supply a go built with openssl linkage (jsc#SLE-18320).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2092-1 advisory.

    This update for go1.26-openssl fixes the following issues

    Security issues:

    - CVE-2026-33811: net: crash when handling long CNAME response (bsc#1264508).
    - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE     (bsc#1264506).
    - CVE-2026-39817: cmd/go: 'go tool pack' does not sanitize output paths (bsc#1264505).
    - CVE-2026-39819: cmd/go: 'go bug' follows symlinks in predictable temporary filenames (bsc#1264504).
    - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment (bsc#1264503).
    - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
    - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams     parameters       (bsc#1264500).
    - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
    - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows (bsc#1264501).
    - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase (bsc#1264502).
    - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).

    Non security issues:

    - go1.26 release tracking (bsc#1255111).
    - Go packages miss binutils-gold dependency (bsc#1170826).
    - supply a go built with openssl linkage (jsc#SLE-18320).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2093-1 advisory.

    This update for go1.25-openssl fixes the following issues

    Security issues:

    - CVE-2026-33811: net: crash when handling long CNAME response (bsc#1264508).
    - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE     (bsc#1264506).
    - CVE-2026-39817: cmd/go: 'go tool pack' does not sanitize output paths (bsc#1264505).
    - CVE-2026-39819: cmd/go: 'go bug' follows symlinks in predictable temporary filenames (bsc#1264504).
    - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment (bsc#1264503).
    - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
    - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams     parameters       (bsc#1264500).
    - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
    - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows (bsc#1264501).
    - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase (bsc#1264502).
    - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).

    Non security issues:

    - go1.25 release tracking (bsc#1244485).
    - Go packages miss binutils-gold dependency (bsc#1170826).
    - supply a go built with openssl linkage (jsc#SLE-18320).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2078-1 advisory.

    This update for go1.26-openssl fixes the following issues

    Security issues:

    - CVE-2026-33811: net: crash when handling long CNAME response (bsc#1264508).
    - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE     (bsc#1264506).
    - CVE-2026-39817: cmd/go: 'go tool pack' does not sanitize output paths (bsc#1264505).
    - CVE-2026-39819: cmd/go: 'go bug' follows symlinks in predictable temporary filenames (bsc#1264504).
    - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment (bsc#1264503).
    - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
    - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams     parameters       (bsc#1264500).
    - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
    - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows (bsc#1264501).
    - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase (bsc#1264502).
    - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).

    Non security issues:

    - go1.26 release tracking (bsc#1255111).
    - Go packages miss binutils-gold dependency (bsc#1170826).
    - supply a go built with openssl linkage (jsc#SLE-18320).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).
    (CVE-2026-39836)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1862-1 advisory.

    This update for go1.25 fixes the following issues

    Security issues:

    - CVE-2026-33811: net: crash when handling long CNAME response (bsc#1264508).
    - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE     (bsc#1264506).
    - CVE-2026-39817: cmd/go: 'go tool pack' does not sanitize output paths (bsc#1264505).
    - CVE-2026-39819: cmd/go: 'go bug' follows symlinks in predictable temporary filenames (bsc#1264504).
    - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment (bsc#1264503).
    - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
    - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams     parameters       (bsc#1264500).
    - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
    - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows (bsc#1264501).
    - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase (bsc#1264502).
    - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).

    Non security issues:

    - Updated to go1.25.10 (bsc#1244485).
    - Go packages miss binutils-gold dependency (bsc#1170826).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1861-1 advisory.

    This update for go1.26 fixes the following issues

    Security issues:

    - CVE-2026-33811: net: crash when handling long CNAME response (bsc#1264508).
    - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE     (bsc#1264506).
    - CVE-2026-39817: cmd/go: 'go tool pack' does not sanitize output paths (bsc#1264505).
    - CVE-2026-39819: cmd/go: 'go bug' follows symlinks in predictable temporary filenames (bsc#1264504).
    - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment (bsc#1264503).
    - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
    - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams     parameters       (bsc#1264500).
    - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
    - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows (bsc#1264501).
    - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase (bsc#1264502).
    - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).

    Non security issues:

    - go1.26 release tracking (bsc#1255111).
    - Go packages miss binutils-gold dependency (bsc#1170826).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Golang running on the remote host is 1.25.x prior to 1.25.10, or 1.26.x prior to 1.26.3. It is, therefore, affected by multiple vulnerabilities, including:

- The net package's LookupCNAME function could trigger a double-free crash when using the cgo DNS resolver     with very long CNAME responses. (CVE-2026-33811)  

- A symlink-handling flaw in the `go bug` command could allow an attacker to overwrite files in the system     temporary directory. (CVE-2026-39819)

  - Additional flaws affecting net, net/mail, and html/template that could be abused for denial of service or     incorrect output escaping. (CVE-2026-39836, CVE-2026-42499, CVE-2026-39820, CVE-2026-39826)   Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).
    (CVE-2026-39836)

ID	Name	Product	Family	Severity
326021	openSUSE 16 Security Update : go1.26-openssl (openSUSE-SU-2026:21254-1)	Nessus	SuSE Local Security Checks	critical
322582	Oracle Linux 9 : golang (ELSA-2026-22121)	Nessus	Oracle Linux Local Security Checks	medium
320798	Photon OS 5.0: Go PHSA-2026-5.0-0869	Nessus	PhotonOS Local Security Checks	medium
318661	Oracle Linux 8 : go-toolset:ol8 (ELSA-2026-22112)	Nessus	Oracle Linux Local Security Checks	medium
317724	SUSE SLED15 / SLES15 Security Update : go1.25-openssl (SUSE-SU-2026:2079-1)	Nessus	SuSE Local Security Checks	medium
317722	SUSE SLES15 Security Update : go1.26-openssl (SUSE-SU-2026:2092-1)	Nessus	SuSE Local Security Checks	medium
317666	SUSE SLES15 Security Update : go1.25-openssl (SUSE-SU-2026:2093-1)	Nessus	SuSE Local Security Checks	medium
317661	SUSE SLED15 / SLES15 Security Update : go1.26-openssl (SUSE-SU-2026:2078-1)	Nessus	SuSE Local Security Checks	medium
315685	Linux Distros Unpatched Vulnerability : CVE-2026-39836	Nessus	Misc.	high
315061	SUSE SLED15 / SLES15 Security Update : go1.25 (SUSE-SU-2026:1862-1)	Nessus	SuSE Local Security Checks	medium
315037	SUSE SLED15 / SLES15 Security Update : go1.26 (SUSE-SU-2026:1861-1)	Nessus	SuSE Local Security Checks	medium
314962	Golang 1.25.x < 1.25.10 / 1.26.x < 1.26.3 Multiple Vulnerabilities	Nessus	Misc.	medium
441502	Golang: stdlib: security update to 1.25.10stdlib: security update to 1.26.3	Tenable Cloud Security	Golang	high
441502	Golang: stdlib: security update to 1.25.10stdlib: security update to 1.26.3	Tenable Self-Hosted Container Security	Golang	high

Detections

Analytics

CVE-2026-39836

high

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

high

high