go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21210-1 advisory.

    This update for google-osconfig-agent fixes the following issues

    - CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers.
    - CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML     documents       (bsc#1251453).
    - CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when     processing specially       crafted input (bsc#1251704).
    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2     :path pseudo-       header (bsc#1260264).
    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265762).
    - CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead     to a denial of       service (bsc#1262926).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266603).
    - CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh     (bsc#1266171).
    - CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).
    - CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh     (bsc#1266171).
    - CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in     golang.org/x/crypto/ssh       (bsc#1266171).
    - CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in     golang.org/x/crypto/ssh       (bsc#1266171).
    - CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent       (bsc#1266171).
    - CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).
    - CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).
    - CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh     (bsc#1266171).
    - CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in     golang.org/x/crypto/ssh/knownhosts       (bsc#1266171).
    - CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in     golang.org/x/crypto/ssh       (bsc#1266171).
    - CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh     (bsc#1266171).
    - CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent     (bsc#1266171).
    - CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following     redirects during       smart-HTTP clone and fetch operations (bsc#1264923).

    Changes for google-osconfig-agent:

    - Update to version 20260615.01
     * Upgrade golang.org/x/crypto & golang.org/x/net (#1006)
    - from version 20260615.00
     * Add unit tests for ospatch_apt_upgrade.go (#938)
    - Update to version 20260611.00
     * Add unit tests for policies/policies.go PART 5 (#998)
    - from version 20260610.00
     * Add unit tests for policies/policies.go PART 4 (#997)
    - from version 20260609.02
     * squash commits (#936)
    - from version 20260609.01
     * Add unit tests for policies/policies.go PART 3 (#996)
    - from version 20260609.00
     * Add unit tests for policies/policies.go PART 2 (#991)
    - from version 20260602.01
     * Align format of dates and timestamp collected across Windows packages (#973)
    - from version 20260602.00
     * Add unit tests for config/config,go (#979)
    - from version 20260528.00
     * Bump github.com/containerd/containerd (#990)
    - from version 20260521.00
     * Cover agentconfig functionality by unit tests (#925)
    - from version 20260520.04
     * Add unit tests for policies/googet.go (#961)
     * Bump github.com/go-git/go-git/v5 (#987)
    - from version 20260520.02
     * Add unit tests for policies/yum.go (#952)
     * Add unit tests for policies/apt.go PART 3 (#951)
    - from version 20260520.00
     * Add unit tests for policies/zypper.go (#953)
    - from version 20260519.00
     * Add unit tests for policies/policies.go PART 1 (#949)
    - from version 20260513.01
     * Bump github.com/go-git/go-git/v5 (#981), this also updates      golang.org/x/net to v0.53.0 (bsc#1265762, CVE-2026-33814)
    - from version 20260513.00
     * upgrade a few packages (#980)
    - from version 20260512.02
     * Add/improve unit tests for agentendpoint/exec_task.go (#933)
    - from version 20260512.01
     * Cover google_update.go by unit tests (#941)
    - from version 20260512.00
     * Change zone for arm64 builds because of stockout (#978)
    - Update to version 20260511.00
     * switch to t2a-standard-2 on ARM package build (#977)
    - from version 20260505.03
     * Cover zypper_patch by unit tests (#958)
    - from version 20260505.02
     * Remove unused functions DisableAutoUpdates (#970)
    - from version 20260505.01
     * Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc (#966)
    - from version 20260505.00
     * Upgrade a few dependencies across the repo (#968)      + github.com/go-git/go-git/v5 5.16.2->5.18.0 (bsc#1264923, CVE-2026-41506)      + github.com/go-jose/go-jose/v4 4.1.3->4.1.4 (bsc#1262926, CVE-2026-34986)      + github.com/go-viper/mapstructure/v2 2.3.0->2.4.0      + go.opentelemetry.io/otel 1.40.0->1.41.0      + go.opentelemetry.io/otel/sdk 1.39.0->1.43.0
    - from version 20260504.01
     * bump github.com/docker/cli to 29.2.0 (#962)
    - from version 20260504.00
     * Bump github.com/opencontainers/selinux (#960)
    - Update to version 20260428.00
     * Add/improve unit tests for agentendpoint/agentendpoint.go (#930)
    - from version 20260427.03
     * Cover config/file.go by unit tests (#935)
    - from version 20260422.01
     * Cover patch_linux.go by unit tests (#932)
    - from version 20260422.00
     * upgrade grpc package in main package and e2e tests (#959)      (bsc#1260264, CVE-2026-33186)
    - from version 20260417.04
     * Bump OSV-Scalibr version to v0.4.3 (#956)
    - from version 20260417.03
     * Add unit tests for updates_linux.go (#937)
    - from version 20260417.02
     * Add zone to CreateDisk step (#955)
    - from version 20260417.01
     * Change disk type for deb11 (#954)
    - from version 20260417.00
     * Add unit tests for policies/apt.go PART 1 (#950)
    - from version 20260410.02
     * Add unit tests for packages/pty_linux.go (#943)
    - from version 20260410.01
     * fix disk type for arm workflows (#948)
    - from version 20260410.00
     * Change machine type for arm based workflows (#946)
    - Update to version 20260330.00
     * bump timeouts for all workflows (#940)
    - from version 20260326.00
     * Cover exec_resource.go by unit tests (#934)
    - from version 20260318.00
     * Integrate OSConfig agent with ReportVmInventory (#923)
    - from version 20260313.02
     * remove cacheonly flag from yum upgrade (#924)
    - from version 20260313.01
     * conditions python version override (#927)
    - from version 20260313.00
     * Fix presubmits by explicitly set python version for rpm based systems (#926)
    - from version 20260311.00
     * Bump osconfig version (#922)
    - from version 20260309.02
     * Extend OSV scalibr extractor (#921)
    - from version 20260309.01
     * upgrade golang.org/x/crypto and it's transitive deps (#918)
    - from version 20260309.00
     * Add purl to pkg info (#920)
    - from version 20260306.00
     * Add 'Type' field to PkgInfo (#919)
    - from version 20260303.01
     * Upgrade go.opentelemetry.io/otel/sdk (#913)
    - from version 20260303.00
     * Bump github.com/vbatts/tar-split from 0.11.5 to 0.12.2 (#908)
    - from version 20260302.00
     * Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.7 (#906)
    - from version 20260126.00
     * Bump go.opentelemetry.io/otel/sdk from 1.38.0 to 1.39.0 (#905)
     * Bump github.com/sirupsen/logrus (#894)
    - Update to version 20260119.00
     * Bump cloud.google.com/go/storage from 1.56.0 to 1.58.0 (#899)
    - Update to version 20251230.00
     * chore: Migrate gsutil usage to gcloud storage (#904)
    - from version 20251223.00
     * fix e2e tests for report inventory (#903)
    - from version 20251222.01
     * Revert Bump cloud.google.com/go/longrunning from 0.6.3 to 0.7.0 (#882) (#902)
    - from version 20251222.00
     * Bump golang to the new version (#900)
    - from version 20251218.00
     * add new CODEOWNERS (#901)
    - from version 20251217.00
     * Bump cloud.google.com/go/longrunning from 0.6.3 to 0.7.0 (#882)
    - Bump the golang compiler version to 1.24.5
    - Update to version 20251202.00
     * Revert Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.5 (#887) (#893)
    - Update to version 20251201.00
     * Revert Bump github.com/containerd/containerd (#890) (#892)
    - Update to version 20251126.00
     * Bump github.com/containerd/containerd (#890)
     * Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.5 (#887)
    - Update to version 20251028.00
     * Bump go.opentelemetry.io/otel/sdk/metric from 1.35.0 to 1.38.0 (#886)
     * Bump github.com/tidwall/pretty from 1.2.0 to 1.2.1 (#880)
    - from version 20251023.02
     * Create multiple_os.yaml (#883)
    - from version 20251023.00
     * Bump github.com/docker/go-connections from 0.4.0 to 0.6.0 (#877)
     * Add test runner for e2e tests (#876)
    - Update to version 20250925.00
     * Bump cloud.google.com/go/auth/oauth2adapt from 0.2.7 to 0.2.8 (#870)
     * Bump google.golang.org/protobuf from 1.36.6 to 1.36.9 (#874)
     * Bump go.opentelemetry.io/otel from 1.35.0 to 1.38.0 (#872)
     * Bump github.com/golang/glog from 1.2.4 to 1.2.5 (#830)
    - Update to version 20250902.01
     * Bump github.com/googleapis/enterprise-certificate-proxy (#829)
    - from version 20250902.00
     * update github.com/go-jose/go-jose/v4 (#869)
     * Upgrade scalibr and other deps (#866)
    - from version 20250901.00
     * Fix possibility of path traversal for zip and tar archival (#868)
    - from version 20250825.00
     * set CODEOWNERS file as required by org (#863)
    - from version 20250819.00
     * Fix/rhel10 build centos image (#860)
    - from version 20250814.00
     * Fix/rhel10 build image (#859)
    - from version 20250813.00
     * Fix: Add RHEL 10 support to RPM startup script (#858)
    - from version 20250811.00
     * Remove old/sles-15-sp4-sap as image is deprecated (#857)
    - Update to version 20250806.00
     * Fixed JSON identifier for the universe domain (#855)
    - from version 20250729.00
     * Bump github.com/google/s2a-go from 0.1.8 to 0.1.9 (#828)
    - from version 20250725.02
     * Update utils.go (#854)
     * Upgrade golang.org/x/oauth2 package to the latest. (#853)
     * Bump golang.org/x/time from 0.9.0 to 0.12.0 (#839)
    - from version 20250725.01
     * Bump golang.org/x/oauth2 (#848)
     * Port fix for debian 11 to goo package manager. (#852)
    - from version 20250725.00
     * Update Golang version in common.sh and skip backports      repo for debian 11 (#850)
    - from version 20250723.01
     * Add workflows to build package for el10 (#849)
    - from version 20250721.00
     * Make OS Config agent TPC aware (#846)
    - from version 20250718.00
     * Create workflows for new Debian 13. (#847)
    - Update to version 20250703.00
     * Fix sles images (#844)
    - from version 20250702.00
     * Remove rhel-sap 8-4 add rhel-sap 8-10 (#843)
    - from version 20250701.00
     * Bump the go_modules group across 1 directory with 2 updates (#840)
    - Update to version 20250606.00
     * Change base docker images Google's official base images. (#838)
    - Update to version 20250523.01
     * Add a simple no-op OS policy for user testing (#837)
    - from version 20250523.00
     * Introduce scalibr inventory extractor for dpkg/rpm/cos      os/filesystem extractors (linux) (#834)
     * Trace GetInstalledPackages memory levels (#835)
    - from version 20250520.00
    - Update to version 20250513.00
     * Fix rpm extractor, handle (none) value correctly. (#833)
    - from version 20250512.01
     * Bump github.com/envoyproxy/go-control-plane from 0.13.1 to 0.13.4 (#816)
    - from version 20250512.00
     * Bump golang.org/x/net from 0.39.0 to 0.40.0 (#819)
    - from version 20250508.01
     * cosmetic refactoring to osinfo package (#826)
    - from version 20250508.00
     * Refactor /inventory with dependency injection (#825)
     * Add debian, ubuntu (InstalledDebPackages) snapshots (#821)
     * cover packages_linux.go file with tests (#824)
     * Add debian (10,11,12) GetPackageUpdates output snapshots (#822)
    - from version 20250507.00
     * Add InstalledRPMPackages snapshot tests (#823)
    - from version 20250506.02
     * Yum tests: simplify initialization of exit errors (#820)
    - from version 20250506.01
     * Improve test coverage for gem package manager (#818)
    - from version 20250506.00
     * after go/x/crypto update 0.32.0 -> 0.37.0 (#817)
    - from version 20250505.01
     * Improve packages package coverage (#814)
     * Bump golang.org/x/net from 0.34.0 to 0.39.0 (#807)
    - from version 20250505.00
     * Bump golang.org/x/crypto from 0.32.0 to 0.37.0 (#806)
    - from version 20250430.00
     * Snapshot YumUpdates (GetPackageUpdates) output (#813)
    - from version 20250428.00
     * Snapshot ZypperPatches, ZypperUpdates (GetPackageUpdates) output      for sles 12, 15 testdata (#812)
    - from version 20250423.00
     * Introduce MatchSnapshot large test results matcher function, snapshot      apt-deb GetPackageUpdates (#811)
    - from version 20250416.02

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2665-1 advisory.

    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2:
    path pseudo-       header (bsc#1260264).
    - CVE-2026-39821: Update golang.org/x/net/idna dependency (bsc#1266603).
    - CVE-2026-39827: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-39828: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-39829: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-39830: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-39831: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-39832: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-39833: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-39834: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-39835: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-42508: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-46595: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-46597: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-46598: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-33814: Update golang.org/x/net dependency (bsc#1265762).
    - CVE-2026-41506: Update github.com/go-git/go-git/v5 dependency (bsc#1264923).
    - CVE-2026-34986: Update github.com/go-jose/go-jose/v4 dependency (bsc#1262926).

    Other bugfixes:

    - Re-enable binary stripping and debuginfo (bsc#1210938).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1879 advisory.

    go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and     6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP     clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.
    (CVE-2026-41506)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of amazon-ssm-agent installed on the remote host is prior to 3.3.4624.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3378 advisory.

    go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and     6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP     clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.
    (CVE-2026-41506)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2468-1 advisory.

    This update for amazon-ssm-agent fixes the following issues

    Update to version 3.3.4624.0:

    - CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of     golang.org/x/crypto/ssh       (bsc#1239342).
    - CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
    - CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected     message type in       response to a key listing or signing request (bsc#1253611).
    - CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for     specific inputs       (bsc#1265474).
    - CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack     and .idx files       can lead to the consumption of corrupted files (bsc#1258095).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege esca (bsc#1266781).
    - CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following     redirects during       smart-HTTP clone and fetch operations (bsc#1264952).
    - CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to     DoS via infinite       loops, panics or resource consumption (bsc#1267332).
    - CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
    - CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in     golang.org/x/crypto/ssh       (bsc#1266200).
    - CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in     golang.org/x/crypto/ssh       (bsc#1266200).
    - CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent       (bsc#1266200).
    - CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
    - CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
    - CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in     golang.org/x/crypto/ssh/knownhosts       (bsc#1266200).
    - CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in     golang.org/x/crypto/ssh       (bsc#1266200).
    - CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent     (bsc#1266200).

    Changes:

     * Bump golang.org/x/crypto from v0.51.0 to v0.52.0
     * Bump golang.org/x/net from v0.54.0 to v0.55.0
     * Enforce directory boundary in BuildSafePath
     * Fix visibility issue with Bottlerocket OS in document output
     * Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this        also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
     * Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
     * Quit if sysprep failed and log its current state
     * Remove attached legacy cloudwatch plugin packages
     * Upgrade Go version to 1.25.10
     * Use BuildSafePath wherever it is applicable
     * Add OOM killer protection to systemd service files
     * Apply more sanitation to file and registry inventory gatherers
     * Bump go-git to v5.17.1
     * Deprecate legacy cloudwatch plugin
     * Preserve network error details in credential refresher SSM API failures
     * Upgrade Go version to 1.25.9
     * Add SSM Distributor support for Bottlerocket OS
     * Implement flush credentials command in ssm-cli
     * Log ec2messages access denied as debug instead of error to reduce log noise
     * Make credential refresher refresh cache quickly in case of credential flush
     * Make Greengrass component registration resilient with retry
     * Add EnforceWorkspaceRootOwnership configuration to support disable        hardening of agent workspace
     * Add reboot comment to Windows shutdown command for SSM Agent traceability
     * Update privilege access check to verify ownership and permissions        of document state files
     * Add read-only version check prior to install and uninstall        in case of occupied package manager locks
     * Add ANSI processing for CloudWatch and S3 log
     * Upgrade go-git to v5.17.0 and cloudflare/circl to v1.6.3        to fix CVE-2026-1229
    - Switch to systemd-tmpfiles to store runtime data (jsc#PED-14843)
     * Disable Go 1.25 container-aware GOMAXPROCS to prevent holding        cgroup file descriptors open
     * Upgrade Go version to 1.25.8
     * Document CommandWorkerBufferLimit config
     * Include package update in Dockerfile
     * Reduce CloudWatch event message length threshold
     * Upgrade Go version to 1.25.7
     * Update github.com/go-git/go-git/v5 to 5.16.5 (bsc#1258095, CVE-2026-25934)
     * Update greengrass version
     * Update Golang version to 1.24.12
     * Updating golang.org/x/crypto from v0.37.0 to v0.47.0, golang.org/x/net        from v0.39.0 to v0.48.0 and golang.org/x/sys from v0.32.0 to v0.40.0        (bsc#1253611, CVE-2025-47913)
     * Categorize integration tests by adding new tags to split fast and slow ones
     * Fix bug where IP field being empty string and causing UII API failure
     * Allow Patch execution to persist across reboots not registered to SSM Agent
     * Fix ENV_VAR interpolation to work correctly with parameter store value
     * Implement immediate retries for failed reply messages to MGS for RunCommand documents
     * Improve ssm-cli get-diagnostics command log output
     * Support DomainJoin endpoint for EU sovereign cloud
     * Support dualstack S3 endpoint for distributor packages
     * Upgrade Go version to 1.24.11
     * Add initial IPv6 support with UseDualStackEndpoint configuration option
     * Fix CPU utilization issue for instances with thousands of network interfaces
     * Add IMDS retry count to account for EC2 droplet refresh
     * Fix duplicate uid error logging in MDS module
     * Update aws:Domainjoin plugin logging from Log4Net to NLog
     * Upgrade Go version to 1.24.7
     * Update github.com/go-git/go-git/v5 to 5.15.0
     * Update golang.org/x/crypto to v0.37.0 (bsc#1238702, CVE-2025-22870)
     * Update golang.org/x/net to v0.39.0
     * Update golang.org/x/sys to v0.32.0
     * Add EU sovereign cloud S3 endpoint for DownloadContent plugin
     * Add configurable credential rotation max backoff interval
     * Migrate from twinj/uuid to google/uuid library
     * Allow newer agent versions to be installed when deploying on Greengrass
     * Harden function to remove non-admin run command documents in execution path
     * Fix macOS credential refresher test issue due to missing Debugf from serialport skip file
     * Enhance testability of custom certificate usage in debug SSM Agent builds
     * Decouple serial port from startup and add credential refresher serialport logging
     * Add GlobalEnhancedTelemetryEnabled config to README
     * Add cloudwatch logs endpoint configuration to optional config for agent
     * Update Greengrass component version
     * Add file privilege check before processing document state file
     * Storing AWS document interpolation ENV_VAR types as environment variables
     * Throw explicit error when running local cli as non-priviledged user
     * Harden telemetry dynamic config folder permissions
     * Add configuration option for HandshakeTimeout
     * Improve unit tests
     * Add setup for emitting telemetry logs and metrics
     * Add initial selection of error logs to emit to telemetry
     * Simplify checkstyle and import organization in build scripts
     * Update golang.org/x/net from v0.37.0 to v0.38.0
     * Agent hibernation reason is logged to EC2 system logs
     * Add metrics for the EC2Detector and IMDS EC2 status findings
     * Change Linux DomainJoin plugin parameter KeepHostName to accept        both boolean and string
     * Upgrade GoLang to version 1.23.8
     * Update golang.org/x/crypto from v0.32.0 to v0.36.0 (bsc#1239342, CVE-2025-22869)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2467-1 advisory.

    This update for amazon-ssm-agent fixes the following issues

    Update to version 3.3.4624.0:

    - CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of     golang.org/x/crypto/ssh       (bsc#1239342).
    - CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
    - CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected     message type in       response to a key listing or signing request (bsc#1253611).
    - CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for     specific inputs       (bsc#1265474).
    - CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack     and .idx files       can lead to the consumption of corrupted files (bsc#1258095).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege esca (bsc#1266781).
    - CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following     redirects during       smart-HTTP clone and fetch operations (bsc#1264952).
    - CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to     DoS via infinite       loops, panics or resource consumption (bsc#1267332).
    - CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
    - CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in     golang.org/x/crypto/ssh       (bsc#1266200).
    - CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in     golang.org/x/crypto/ssh       (bsc#1266200).
    - CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent       (bsc#1266200).
    - CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
    - CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
    - CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in     golang.org/x/crypto/ssh/knownhosts       (bsc#1266200).
    - CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in     golang.org/x/crypto/ssh       (bsc#1266200).
    - CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent     (bsc#1266200).

    Changes:

     * Bump golang.org/x/crypto from v0.51.0 to v0.52.0
     * Bump golang.org/x/net from v0.54.0 to v0.55.0
     * Enforce directory boundary in BuildSafePath
     * Fix visibility issue with Bottlerocket OS in document output
     * Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this        also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
     * Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
     * Quit if sysprep failed and log its current state
     * Remove attached legacy cloudwatch plugin packages
     * Upgrade Go version to 1.25.10
     * Use BuildSafePath wherever it is applicable
     * Add OOM killer protection to systemd service files
     * Apply more sanitation to file and registry inventory gatherers
     * Bump go-git to v5.17.1
     * Deprecate legacy cloudwatch plugin
     * Preserve network error details in credential refresher SSM API failures
     * Upgrade Go version to 1.25.9
     * Add SSM Distributor support for Bottlerocket OS
     * Implement flush credentials command in ssm-cli
     * Log ec2messages access denied as debug instead of error to reduce log noise
     * Make credential refresher refresh cache quickly in case of credential flush
     * Make Greengrass component registration resilient with retry
     * Add EnforceWorkspaceRootOwnership configuration to support disable        hardening of agent workspace
     * Add reboot comment to Windows shutdown command for SSM Agent traceability
     * Update privilege access check to verify ownership and permissions        of document state files
     * Add read-only version check prior to install and uninstall        in case of occupied package manager locks
     * Add ANSI processing for CloudWatch and S3 log
     * Upgrade go-git to v5.17.0 and cloudflare/circl to v1.6.3        to fix CVE-2026-1229
    - Switch to systemd-tmpfiles to store runtime data (jsc#PED-14843)
     * Disable Go 1.25 container-aware GOMAXPROCS to prevent holding        cgroup file descriptors open
     * Upgrade Go version to 1.25.8
     * Document CommandWorkerBufferLimit config
     * Include package update in Dockerfile
     * Reduce CloudWatch event message length threshold
     * Upgrade Go version to 1.25.7
     * Update github.com/go-git/go-git/v5 to 5.16.5 (bsc#1258095, CVE-2026-25934)
     * Update greengrass version
     * Update Golang version to 1.24.12
     * Updating golang.org/x/crypto from v0.37.0 to v0.47.0, golang.org/x/net        from v0.39.0 to v0.48.0 and golang.org/x/sys from v0.32.0 to v0.40.0        (bsc#1253611, CVE-2025-47913)
     * Categorize integration tests by adding new tags to split fast and slow ones
     * Fix bug where IP field being empty string and causing UII API failure
     * Allow Patch execution to persist across reboots not registered to SSM Agent
     * Fix ENV_VAR interpolation to work correctly with parameter store value
     * Implement immediate retries for failed reply messages to MGS for RunCommand documents
     * Improve ssm-cli get-diagnostics command log output
     * Support DomainJoin endpoint for EU sovereign cloud
     * Support dualstack S3 endpoint for distributor packages
     * Upgrade Go version to 1.24.11
     * Add initial IPv6 support with UseDualStackEndpoint configuration option
     * Fix CPU utilization issue for instances with thousands of network interfaces
     * Add IMDS retry count to account for EC2 droplet refresh
     * Fix duplicate uid error logging in MDS module
     * Update aws:Domainjoin plugin logging from Log4Net to NLog
     * Upgrade Go version to 1.24.7
     * Update github.com/go-git/go-git/v5 to 5.15.0
     * Update golang.org/x/crypto to v0.37.0 (bsc#1238702, CVE-2025-22870)
     * Update golang.org/x/net to v0.39.0
     * Update golang.org/x/sys to v0.32.0
     * Add EU sovereign cloud S3 endpoint for DownloadContent plugin
     * Add configurable credential rotation max backoff interval
     * Migrate from twinj/uuid to google/uuid library
     * Allow newer agent versions to be installed when deploying on Greengrass
     * Harden function to remove non-admin run command documents in execution path
     * Fix macOS credential refresher test issue due to missing Debugf from serialport skip file
     * Enhance testability of custom certificate usage in debug SSM Agent builds
     * Decouple serial port from startup and add credential refresher serialport logging
     * Add GlobalEnhancedTelemetryEnabled config to README
     * Add cloudwatch logs endpoint configuration to optional config for agent
     * Update Greengrass component version
     * Add file privilege check before processing document state file
     * Storing AWS document interpolation ENV_VAR types as environment variables
     * Throw explicit error when running local cli as non-priviledged user
     * Harden telemetry dynamic config folder permissions
     * Add configuration option for HandshakeTimeout
     * Improve unit tests
     * Add setup for emitting telemetry logs and metrics
     * Add initial selection of error logs to emit to telemetry
     * Simplify checkstyle and import organization in build scripts
     * Update golang.org/x/net from v0.37.0 to v0.38.0
     * Agent hibernation reason is logged to EC2 system logs
     * Add metrics for the EC2Detector and IMDS EC2 status findings
     * Change Linux DomainJoin plugin parameter KeepHostName to accept        both boolean and string
     * Upgrade GoLang to version 1.23.8
     * Update golang.org/x/crypto from v0.32.0 to v0.36.0 (bsc#1239342, CVE-2025-22869)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:20720-1 advisory.

    Changes in trivy:

    - update go-git to 5.18.0 (bsc#1264873, CVE-2026-41506)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and     6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP     clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.
    (CVE-2026-41506)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and
    6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP
    clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.
    (CVE-2026-41506)

ID	Name	Product	Family	Severity
325024	openSUSE 16 Security Update : google-osconfig-agent (openSUSE-SU-2026:21210-1)	Nessus	SuSE Local Security Checks	high
323248	SUSE SLES12 Security Update : google-osconfig-agent (SUSE-SU-2026:2665-1)	Nessus	SuSE Local Security Checks	high
322098	Amazon Linux 2023 : amazon-ssm-agent (ALAS2023-2026-1879)	Nessus	Amazon Linux Local Security Checks	high
322090	Amazon Linux 2 : amazon-ssm-agent, --advisory ALAS2-2026-3378 (ALAS-2026-3378)	Nessus	Amazon Linux Local Security Checks	high
321922	SUSE SLES12 Security Update : amazon-ssm-agent (SUSE-SU-2026:2468-1)	Nessus	SuSE Local Security Checks	medium
321917	SUSE SLES15 Security Update : amazon-ssm-agent (SUSE-SU-2026:2467-1)	Nessus	SuSE Local Security Checks	medium
315033	openSUSE 16 Security Update : trivy (openSUSE-SU-2026:20720-1)	Nessus	SuSE Local Security Checks	high
313456	Linux Distros Unpatched Vulnerability : CVE-2026-41506	Nessus	Misc.	high
440605	SCA: security update for github.com/go-git/go-git/v5, github.com/go-git/go-git/v6 (GHSA-3xc5-wrhm-f963)	Tenable Cloud Security	SCA Checks	high
440605	SCA: security update for github.com/go-git/go-git/v5, github.com/go-git/go-git/v6 (GHSA-3xc5-wrhm-f963)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-41506

high

Tenable Plugins

high

high

high

high

medium

medium

high

high

high

high