The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).

An update of the go package has been released.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-22112 advisory.

    delve     [1.25.2-1.0.1]     golang     [1.25.9-1.0.1]
    - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var
    - Backported from OL9u7
    - Resolves: OLDIS-53586

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2079-1 advisory.

    This update for go1.25-openssl fixes the following issues

    Security issues:

    - CVE-2026-33811: net: crash when handling long CNAME response (bsc#1264508).
    - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE     (bsc#1264506).
    - CVE-2026-39817: cmd/go: 'go tool pack' does not sanitize output paths (bsc#1264505).
    - CVE-2026-39819: cmd/go: 'go bug' follows symlinks in predictable temporary filenames (bsc#1264504).
    - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment (bsc#1264503).
    - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
    - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams     parameters       (bsc#1264500).
    - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
    - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows (bsc#1264501).
    - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase (bsc#1264502).
    - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).

    Non security issues:

    - go1.25 release tracking (bsc#1244485).
    - Go packages miss binutils-gold dependency (bsc#1170826).
    - supply a go built with openssl linkage (jsc#SLE-18320).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2092-1 advisory.

    This update for go1.26-openssl fixes the following issues

    Security issues:

    - CVE-2026-33811: net: crash when handling long CNAME response (bsc#1264508).
    - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE     (bsc#1264506).
    - CVE-2026-39817: cmd/go: 'go tool pack' does not sanitize output paths (bsc#1264505).
    - CVE-2026-39819: cmd/go: 'go bug' follows symlinks in predictable temporary filenames (bsc#1264504).
    - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment (bsc#1264503).
    - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
    - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams     parameters       (bsc#1264500).
    - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
    - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows (bsc#1264501).
    - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase (bsc#1264502).
    - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).

    Non security issues:

    - go1.26 release tracking (bsc#1255111).
    - Go packages miss binutils-gold dependency (bsc#1170826).
    - supply a go built with openssl linkage (jsc#SLE-18320).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2093-1 advisory.

    This update for go1.25-openssl fixes the following issues

    Security issues:

    - CVE-2026-33811: net: crash when handling long CNAME response (bsc#1264508).
    - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE     (bsc#1264506).
    - CVE-2026-39817: cmd/go: 'go tool pack' does not sanitize output paths (bsc#1264505).
    - CVE-2026-39819: cmd/go: 'go bug' follows symlinks in predictable temporary filenames (bsc#1264504).
    - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment (bsc#1264503).
    - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
    - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams     parameters       (bsc#1264500).
    - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
    - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows (bsc#1264501).
    - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase (bsc#1264502).
    - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).

    Non security issues:

    - go1.25 release tracking (bsc#1244485).
    - Go packages miss binutils-gold dependency (bsc#1170826).
    - supply a go built with openssl linkage (jsc#SLE-18320).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2078-1 advisory.

    This update for go1.26-openssl fixes the following issues

    Security issues:

    - CVE-2026-33811: net: crash when handling long CNAME response (bsc#1264508).
    - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE     (bsc#1264506).
    - CVE-2026-39817: cmd/go: 'go tool pack' does not sanitize output paths (bsc#1264505).
    - CVE-2026-39819: cmd/go: 'go bug' follows symlinks in predictable temporary filenames (bsc#1264504).
    - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment (bsc#1264503).
    - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
    - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams     parameters       (bsc#1264500).
    - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
    - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows (bsc#1264501).
    - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase (bsc#1264502).
    - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).

    Non security issues:

    - go1.26 release tracking (bsc#1255111).
    - Go packages miss binutils-gold dependency (bsc#1170826).
    - supply a go built with openssl linkage (jsc#SLE-18320).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).
    (CVE-2026-39836)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1862-1 advisory.

    This update for go1.25 fixes the following issues

    Security issues:

    - CVE-2026-33811: net: crash when handling long CNAME response (bsc#1264508).
    - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE     (bsc#1264506).
    - CVE-2026-39817: cmd/go: 'go tool pack' does not sanitize output paths (bsc#1264505).
    - CVE-2026-39819: cmd/go: 'go bug' follows symlinks in predictable temporary filenames (bsc#1264504).
    - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment (bsc#1264503).
    - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
    - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams     parameters       (bsc#1264500).
    - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
    - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows (bsc#1264501).
    - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase (bsc#1264502).
    - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).

    Non security issues:

    - Updated to go1.25.10 (bsc#1244485).
    - Go packages miss binutils-gold dependency (bsc#1170826).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1861-1 advisory.

    This update for go1.26 fixes the following issues

    Security issues:

    - CVE-2026-33811: net: crash when handling long CNAME response (bsc#1264508).
    - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE     (bsc#1264506).
    - CVE-2026-39817: cmd/go: 'go tool pack' does not sanitize output paths (bsc#1264505).
    - CVE-2026-39819: cmd/go: 'go bug' follows symlinks in predictable temporary filenames (bsc#1264504).
    - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment (bsc#1264503).
    - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
    - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams     parameters       (bsc#1264500).
    - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
    - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows (bsc#1264501).
    - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase (bsc#1264502).
    - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).

    Non security issues:

    - go1.26 release tracking (bsc#1255111).
    - Go packages miss binutils-gold dependency (bsc#1170826).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Golang running on the remote host is 1.25.x prior to 1.25.10, or 1.26.x prior to 1.26.3. It is, therefore, affected by multiple vulnerabilities, including:

- The net package's LookupCNAME function could trigger a double-free crash when using the cgo DNS resolver     with very long CNAME responses. (CVE-2026-33811)  

- A symlink-handling flaw in the `go bug` command could allow an attacker to overwrite files in the system     temporary directory. (CVE-2026-39819)

  - Additional flaws affecting net, net/mail, and html/template that could be abused for denial of service or     incorrect output escaping. (CVE-2026-39836, CVE-2026-42499, CVE-2026-39820, CVE-2026-39826)   Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
320798	Photon OS 5.0: Go PHSA-2026-5.0-0869	Nessus	PhotonOS Local Security Checks	medium
318661	Oracle Linux 8 : go-toolset:ol8 (ELSA-2026-22112)	Nessus	Oracle Linux Local Security Checks	medium
317724	SUSE SLED15 / SLES15 Security Update : go1.25-openssl (SUSE-SU-2026:2079-1)	Nessus	SuSE Local Security Checks	medium
317722	SUSE SLES15 Security Update : go1.26-openssl (SUSE-SU-2026:2092-1)	Nessus	SuSE Local Security Checks	medium
317666	SUSE SLES15 Security Update : go1.25-openssl (SUSE-SU-2026:2093-1)	Nessus	SuSE Local Security Checks	medium
317661	SUSE SLED15 / SLES15 Security Update : go1.26-openssl (SUSE-SU-2026:2078-1)	Nessus	SuSE Local Security Checks	medium
315685	Linux Distros Unpatched Vulnerability : CVE-2026-39836	Nessus	Misc.	high
315061	SUSE SLED15 / SLES15 Security Update : go1.25 (SUSE-SU-2026:1862-1)	Nessus	SuSE Local Security Checks	medium
315037	SUSE SLED15 / SLES15 Security Update : go1.26 (SUSE-SU-2026:1861-1)	Nessus	SuSE Local Security Checks	medium
314962	Golang 1.25.x < 1.25.10 / 1.26.x < 1.26.3 Multiple Vulnerabilities	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-39836

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

high

medium

medium

medium