Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2438-1 advisory.

    This update for alloy fixes the following issues

    Security issues:

    - CVE-2026-4427: github.com/jackc/pgproto3/v2: improper validation of field length allows a malicious     PostgreSQL server       to crash a client application via a DataRow message (bsc#1259919).
    - CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack     and .idx files       can lead to the consumption of corrupted files (bsc#1258099).
    - CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce     invalid results       and lead to undefined behavior (bsc#1258609).
    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2:
    path pseudo-       header (bsc#1260317).
    - CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead     to a denial of       service (bsc#1262955).
    - CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32     integer overflow       (bsc#1263530).

    Non security issue:

    - Use systemd tmpfiles.d to create /var/lib/alloy hierarchy (jsc#PED-14815).
    - Update to version 1.16.1
     * Bug Fixes      logging: Fix startup deadlock when components log before      logging config is evaluated      Update to Beyla 3.9.8      Migrate from Docker to Moby
    - Use latest openSUSE Tumbleweed image for building web UI assets
    - Install nvm to set node version specified upstream
    - update to 1.16.0:
     * Features
     - Add clustering for loki.source.kubernetes_events (#6027)      (3dbf587) (@petewall)
     - Add otelcol.auth.google client auth provider (#5526)      (da99a66) (@dashpole, @clayton-cornell)
     - beyla.ebpf: Bump to v3.7.0 (#5966) (5126c2e) (@marctc)
     - database_observability: Add support for GCP Cloud SQL      metadata (#5875) (5d23245) (@cristiangreco, @clayton-cornell)
     - database_observability: Make targets optional (#5924)      (54664b2) (@matthewnolf)
     - database_observability: Update default excluded schemas and      users (#6080) (b386fff) (@cristiangreco)
     - faro.receiver: Add sourcemap fetching from remote locations      (#4614) (b6cb5da) (@Oxel40)
     - helm: Add support for global.image.pullPolicy (#6069)      (2e2ce72) (@petewall)
     - helm: Allow configuring image pull policy for config reloader      (#5923) (991539b) (@kalleep)
     - loki.secretfilter: Add label_timed_out option to mark      timed-out log lines (#5898) (2ad8834) (@kleimkuhler)
     - loki.secretfilter: Add secrets_redacted_by_category_total      metric combining rule and origin (#5855) (053a2f7)      (@kleimkuhler)
     - loki.secretfilter: Change secretfilter to use go-re2 regex      library instead of stdlib (#5909) (c16a660) (@mikefat)
     - loki.secretfilter: Remove redundant      secrets_redacted_by_rule_total and secrets_redacted_by_origin      metrics (#5970) (b16decb) (@kleimkuhler)
     - Oracle exporter can scrape more than one DB (#6008) (6fbad38)      (@ptodev)
     - prometheus.exporter.cloudwatch: Upgrade YACE and drop      aws-sdk-go v1 support (#5936) (f1c036d) (@x1unix)
     - prometheus.exporter.mysql: Update to mysqld_exporter 0.19.0      (#5836) (4f49b57) (@cristiangreco)
     - prometheus.remote_write: Sync WAL with upstream Prometheus      (#5907) (e74a91b) (@x1unix)
     - pyroscope: Add support for extra async-profiler CLI arguments      (#5472) (9251e33) (@ivanape)
     - pyroscope: Replace Parca gRPC debuginfo upload with Pyroscope      Connect API (#5891) (e7ea34a) (@korniltsev-grafanista)
     - pyroscope: Update debuginfo client for HTTP/1.1 upload API      (#6037) (879d8e5) (@korniltsev-grafanista)
     - Change service stop command from 'sc' to 'net' (#5906)      (450973d) (@mateuszdrab)
     - database_observability.mysql: Refactor explain plan loop      batch size (#5894) (f0fcd6b) (@cristiangreco)
     - database_observability.postgres: Cleanup embedded exporter      collectors on reconnection (#6079) (f30d9ae) (@cristiangreco)
     - database_observability.postgres: Fix EXPLAIN param count when      placeholders repeat (#6082) (b612b81) (@rgeyer)
     - database_observability: Drop schema_detection from logs      (#6076) (b0105cb) (@cristiangreco)
     - database_observability: Ensure connection_info_monitor      goroutine exits on Stop (#5874) (1e3334b) (@cristiangreco)
     - deps: Update module github.com/aws/aws-sdk-go-v2/service/s3      to v1.97.3 [SECURITY] (#6004) (38f4346)
     - deps: Update module github.com/go-git/go-git/v5 to v5.17.1      [SECURITY] (#5934) (a5154af)
     - deps: Update module github.com/go-git/go-git/v5 to v5.18.0      [SECURITY] (#6090) (0e59d64)
     - deps: Update module github.com/nwaples/rardecode/v2 to v2.2.0      [SECURITY] (b44d51a) (@jharvey10)
     - deps: Update module      go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp      to v1.43.0 [SECURITY] (#6016) (d92c5c0)      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp      to v1.43.0 [SECURITY] (#6017) (e655bbc)
     - deps: Update module go.opentelemetry.io/otel/sdk to v1.43.0      [SECURITY] (#6018) (94006e8)
     - deps: Update some minor go dep versions (#5896) (4ddd0ed)      (@jharvey10)
     - go: Update alloy builder image to Go 1.25.9 (#6012) (d2ae8b8)      (@x1unix)
     - go: Upgrade to Go 1.25.9 (#6019) (d777ed1) (@x1unix,      @kalleep)
     - Helm: RBAC template handles empty rule arrays (#4860)      (c9430e9) (@naptalie, @dehaansa, @kalleep)
     - loki.process: Eliminate per-stream goroutines in multiline      stage (#6036) (c089e2e) (@kgeckhart)
     - loki.process: Prevent stage.structured_metadata from adding      the same metadata several times (#5965) (0ec8a26) (@kalleep,      @thampiotr)
     - loki.process: Wrap template in a custom type and move      validation to syntax.Validator (#5910) (700dd7d) (@kalleep)
     - prometheus.exporter.postgres: Close DB connections on update      (#6021) (8da97cf) (@kalleep)
     - prometheus.scrape: Update scrape_native_histograms to be      updated at runtime (#6087) (18b205c) (@kalleep)
     - pyroscope.ebpf: Fix deadlock on LRU eviction in irsymcache      (#5911) (03ca563) (@luweglarz)
     - pyroscope.ebpf: Move Pyroscope ebpf metrics registration      after component error handling (#5540) (a3c57c0) (@crbednarz,      @marcsanmi)
     - pyroscope: Set user agent on debuginfo connect-go client      (#6022) (38ad1ef) (@korniltsev-grafanista)
     - ui: Large arguments are downloaded as files instead of      rendered (#5268) (26c67b3) (@ptodev)
     - Update go-m1cpu v0.1.7 -> v0.2.1 to fix M5 chip crash (#6034)      (7fa0cbc) (@ymotongpoo)
     - windows-installer: Increase service restart on failure delays      (#5969) (add15b1) (@rknightion)
    - add script to package webassets inside a podman container, to not      endanger or pollute the host system with npm
    - update to 1.15.1:
     goroutine exits on Stop
     * CVE-2026-34986: Fix panic in JWE decryption (bsc#1262955)
    - update to 1.15.0:
     * BREAKING CHANGES
     - otelcol: Upgrade to OTel Collector v0.147.0
     - Renamed undocumented metrics that was previously prefixed      with <component_id><metric_name> to      loki_source_awsfirehose<metric_name>
     * Security      CVE-2026-26958: Update filippo.io/edwards25519 to version 1.1.1      (bsc#1258609).
     - alloy-mixin: Add filters, groupBy, and multi-select dashboard      variables
     - beyla.ebpf: Add support for Prometheus native histograms
     - beyla.ebpf: Bump Beyla to v3.6
     - converters: Support converting Promtail limits_config
     - database_observability.mysql: Add filtering of query samples      and wait events by minimum duration
     - database_observability.mysql: Embed prometheus exporter      within db-o11y component
     - database_observability.postgres: Add configurable limit to      pg_stat_statements query
     - database_observability.postgres: Embed prometheus exporter
     - database_observability: Promote components to stable
     - Expose Functionality to Handle syslogs with Empty MSG Field
     - loki.process: Support structured metadata as source type of      stage.labels for loki.process
     - loki.secretfilter: Add sampling for secretfilter entries
     - loki.source.gcplog: Add alloy config for MaxOutstandingBytes      and MaxOutstandingMessages
     - loki.write: Add loki pipeline latency metric
     - mixin: Update loki dashboard
     - otelcol.receiver.datadog: Expose intake proxy and      trace_id_cache_size settings
     - prometheus.exporter.cloudwatch: Use aws-sdk-go-v2 by default
     - pyroscope.ebpf: Add comm, pid labels and kernel frame options
    - update to 1.14.1:
     - Correctly handle the deprecated topic field in      otelcol.receiver.kafka configuration
     - loki.process: Protect against json that does not look like      docker json format
     - loki.source.file: Keep positions for compressed files when      reading is finished
     - prometheus.scrape: Update arguments and targets even if      scrape_native_histograms and extra_metrics are updated
    - update to 1.14.0:
     - loki.secretfilter: Some config options are removed entirely:
     partial_mask (replaced with redact_percent), allowlist (now      controlled with custom gitleaks config), enable_entropy,      include_generic, types (now controlled with custom gitleaks      config).
     - otelcol.receiver.prometheus: otelcol.receiver.prometheus no      longer sets start times of OTLP metrics.
     * Security:
    - update to 1.13.2:
     - Expose missing otelcol.processor.tail_sampling options
     - mixin: Add zipped dashboards as a release artifact
     - profiler: Backport Go 1.26 gopclntab textStart fix
     - prometheus.exporter.postgres: Update version of the exporter      fork to fix pg_settings
     - pyroscope.ebpf: Backport dotnet nibble map fix
    - update to 1.13.1:
     - timeout before starting new ones
    - update to 1.13.0:
     - otelcol: Upgrade to OTel Collector v0.142.0
     - otelcol.receiver.kafka: The global topic attribute has been      deleted; use the topics attributes inside the logs, metrics,      and traces blocks instead.
     - otelcol.exporter > sending_queue > batch > min_size changed      from 8192 to 2000 and max_size changed from 0 to 3000
     - Add a virtual_node_peer_attributes and      virtual_node_extra_label arguments to      otelcol.connector.servicegraph
     - Add an otelcol.processor.metric_start_time component
     - Add job level period, length, and add_cloudwatch_timestamp      options and labels_snake_case to CW exporter
     - Add missing configuration parameter      deployment_name_from_replicaset to k8sattributes processor
     - Add parcas symbols upload to pyroscope.ebpf
     - Add sharding for loki.write
     - Add unexposed otel engine and extension to codebase and      change build structure
     - beyla.ebpf: Add meta_cache_address to      beyla.ebpf.attributes.kubernetes
     - beyla.ebpf: Upgrade Beyla to v2.8.5
     - Change the defaults for sending_queue > batch block inside      otelcol.exporter components
     - cluster: Support DNS discovery mode prefixes in
     --cluster.join-addresses flag
     - converter: Update promtail converter to use file_match block      for loki.source.file
     - database_observability: Add health check collector for      postgres component
     - database_observability: Expose exclude_schemas and      exclude_databases settings
     - database_observability: Support Azure cloud provider config      data
     - database_observability.mysql: Support excluding schemas in      all collectors
     - database_observability.postgres: Support excluding DBs in all      collectors

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20940-1 advisory.

    Changes in grafana:

    - CVE-2026-39821: Fix validation bypass and privilege escalation by       updating golang.org/x/net to version 0.55.0 (bsc#1266600)

    - Update to version 11.6.14+security-04:
      Security:
      * CVE-2026-28374: Fix insecure direct object reference in         Annotations API (bsc#1265290)
      * CVE-2026-28376: Fix unbounded memory allocation in Grafana Live         push endpoint (bsc#1265289)
      * CVE-2026-28383: Fix unbounded memory allocation in Grafana         plugin resources (bsc#1265286)
      * CVE-2026-28380: Fix broken access control in Snapshot API         (bsc#1265287)
      * CVE-2026-33376: Fix Auth Proxy IPv6 whitelist bypass         (bsc#1265285)
      * CVE-2026-28379: Fix viewer-triggered race condition in         Grafana Live (bsc#1265288)
      * CVE-2026-33377: Fix dashboard Editor Privilege Escalation         (bsc#1265284)
      * CVE-2026-33378: Fix OOM exception in Grafana Data Source Plugin         (bsc#1265283)
      * CVE-2026-33381: Prevent users from generating Service Account         tokens after permissions removal (bsc#1265281)
      * CVE-2026-33380: Fix vulnerability in SQL Expressions allowing         an authenticated attacker to read arbitrary files from the         Grafana servers filesystem (bsc#1265282)

    - CVE-2026-34986: Fix panic in JWE decryption (bsc#1262950)
    - CVE-2026-41602: Fix Integer Overflow or Wraparound vulnerability       in Apache Thrift (bsc#1263501)

    - CVE-2026-26958: Bump filippo.io/edwards25519 to version 1.1.1       (bsc#1258595)
    - CVE-2026-21725: Fix missing UID when deleting datasource by name       (bsc#1258873)

    - Update to version 11.6.14+security-01:
      Security:
      * CVE-2026-33375: Fix denial of Service via out-of-memory         exhaustion in MSSQL data source plugin (bsc#1260881)

    - Update to version 11.6.14:
      Security:
      * CVE-2026-27876: Fix remote arbitrary code execution via chained         SQL Expressions (bsc#1261025)
      * CVE-2026-27877: Fix information disclosure of data-source         passwords via public dashboards (bsc#1261026)
      * CVE-2026-28375: Fix denial of service via testdata data-source         (bsc#1261029)
      * CVE-2026-27879: Fix denial of service via resample query         (bsc#1261027)
      * CVE-2026-33186: Fix authorization bypass due to improper         validation of the HTTP/2 :path pseudo-header (bsc#1260263)
      * CVE-2026-21724: Fix authorization bypass allows modification of         protected webhook URLs (bsc#1260878)

    - Update to version 11.6.13:
      Enhancement:
      * Wire the public dashboard service to the HTTP server

    - Update to version 11.6.12:
      Enhancement:
      * Update authentication redirect logic       Bug fix:
      * Fix single panel render with variable references

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300066.2-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3323 advisory.

    Arithmetic over induction variables in loops were not correctly checked for underflow or overflow in the     Go compiler (cmd/compile). As a result, the compiler would allow for invalid indexing to occur at runtime,     potentially leading to memory corruption in programs compiled with affected Go versions. (CVE-2026-27143)

    The Go compiler (cmd/compile) incorrectly handled no-op interface conversions, preventing correct     determination about non-overlapping memory moves, potentially leading to memory corruption at runtime in     programs compiled with affected Go versions. (CVE-2026-27144)

    During chain building, the amount of work that is done is not correctly limited when a large number of     intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of     service. This affects both direct users of crypto/x509 and users of crypto/tls. (CVE-2026-32280)

    Validating certificate chains which use policies is unexpectedly inefficient when certificates in the     chain contain a very large number of policy mappings, possibly causing denial of service. This only     affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots     CertPool, or in the system certificate pool. (CVE-2026-32281)

    On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress,     Chmod can operate on the target of the symlink, even when the target lies outside the root.
    (CVE-2026-32282)

    If one side of the TLS connection sends multiple key update messages post-handshake in a single record,     the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of     service. This only affects TLS 1.3. (CVE-2026-32283)

    Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading     to 100% CPU usage. This can be triggered by top-level selectors such as 1=1 or true().
    (CVE-2026-32287)

    tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive     containing a large number of sparse regions encoded in the old GNU sparse map format. (CVE-2026-32288)

    Context was not properly tracked across template branches for JS template literals, leading to possibly     incorrect escaping of content. This could cause actions within JS template literals to be incorrectly     escaped, leading to XSS vulnerabilities. (CVE-2026-32289)

    When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of     C memory and a crash. (CVE-2026-33811)

    When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION     frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. (CVE-2026-33814)

    Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive     CPU exhaustion and memory allocations. (CVE-2026-39820)

    CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's     <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the     <content> attribute, the escaper would fail to similarly escape it, leading to XSS. (CVE-2026-39823)

    ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a     Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the     forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not     take ParseQuery's limit on the total number of query parameters (controlled by     GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a     query parameter that is not visible to the Rewrite function. For example, the query     a1=x&a2=x&...&a10000=x&hidden=y can forward the parameter hidden=y while hiding it from the proxy's     Rewrite function. (CVE-2026-39825)

    If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type'     attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed     into the <script> block. (CVE-2026-39826)

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters     (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap.
    This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled     (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.
    (CVE-2026-39882)

    Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation

    This issue affects Apache Thrift: before 0.23.0.

    Users are recommended to upgrade to version 0.23.0, which fixes the issue. (CVE-2026-41602)

    Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC     5322. (CVE-2026-42499)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:21852-1 advisory.

    This update for alloy fixes the following issues

    - CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead     to a denial of       service (bsc#1262955).
    - CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32     integer overflow       (bsc#1263530).

    Changes for alloy:

    - Update to version 1.16.1
     * Bug Fixes      logging: Fix startup deadlock when components log before      logging config is evaluated      Update to Beyla 3.9.8      Migrate from Docker to Moby

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20816-1 advisory.

    This update for alloy fixes the following issues

    - CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead     to a denial of       service (bsc#1262955).
    - CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32     integer overflow       (bsc#1263530).

    Changes for alloy:

    - Update to version 1.16.1
     * Bug Fixes      logging: Fix startup deadlock when components log before      logging config is evaluated      Update to Beyla 3.9.8      Migrate from Docker to Moby

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1747 advisory.

    Arithmetic over induction variables in loops were not correctly checked for underflow or overflow in the     Go compiler (cmd/compile). As a result, the compiler would allow for invalid indexing to occur at runtime,     potentially leading to memory corruption in programs compiled with affected Go versions. (CVE-2026-27143)

    The Go compiler (cmd/compile) incorrectly handled no-op interface conversions, preventing correct     determination about non-overlapping memory moves, potentially leading to memory corruption at runtime in     programs compiled with affected Go versions. (CVE-2026-27144)

    During chain building, the amount of work that is done is not correctly limited when a large number of     intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of     service. This affects both direct users of crypto/x509 and users of crypto/tls. (CVE-2026-32280)

    Validating certificate chains which use policies is unexpectedly inefficient when certificates in the     chain contain a very large number of policy mappings, possibly causing denial of service. This only     affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots     CertPool, or in the system certificate pool. (CVE-2026-32281)

    On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress,     Chmod can operate on the target of the symlink, even when the target lies outside the root.
    (CVE-2026-32282)

    If one side of the TLS connection sends multiple key update messages post-handshake in a single record,     the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of     service. This only affects TLS 1.3. (CVE-2026-32283)

    Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading     to 100% CPU usage. This can be triggered by top-level selectors such as 1=1 or true().
    (CVE-2026-32287)

    tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive     containing a large number of sparse regions encoded in the old GNU sparse map format. (CVE-2026-32288)

    Context was not properly tracked across template branches for JS template literals, leading to possibly     incorrect escaping of content. This could cause actions within JS template literals to be incorrectly     escaped, leading to XSS vulnerabilities. (CVE-2026-32289)

    When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of     C memory and a crash. (CVE-2026-33811)

    When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION     frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. (CVE-2026-33814)

    Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive     CPU exhaustion and memory allocations. (CVE-2026-39820)

    CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's     <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the     <content> attribute, the escaper would fail to similarly escape it, leading to XSS. (CVE-2026-39823)

    ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a     Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the     forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not     take ParseQuery's limit on the total number of query parameters (controlled by     GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a     query parameter that is not visible to the Rewrite function. For example, the query     a1=x&a2=x&...&a10000=x&hidden=y can forward the parameter hidden=y while hiding it from the proxy's     Rewrite function. (CVE-2026-39825)

    If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type'     attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed     into the <script> block. (CVE-2026-39826)

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters     (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap.
    This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled     (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.
    (CVE-2026-39882)

    Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation

    This issue affects Apache Thrift: before 0.23.0.

    Users are recommended to upgrade to version 0.23.0, which fixes the issue. (CVE-2026-41602)

    Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC     5322. (CVE-2026-42499)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation     This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which     fixes the issue. (CVE-2026-41602)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
321596	SUSE SLED15 / SLES15 Security Update : alloy (SUSE-SU-2026:2438-1)	Nessus	SuSE Local Security Checks	medium
321072	openSUSE 16 Security Update : grafana (openSUSE-SU-2026:20940-1)	Nessus	SuSE Local Security Checks	medium
319860	Amazon Linux 2 : amazon-cloudwatch-agent, --advisory ALAS2-2026-3323 (ALAS-2026-3323)	Nessus	Amazon Linux Local Security Checks	critical
318200	SUSE SLES16 Security Update : alloy (SUSE-SU-2026:21852-1)	Nessus	SuSE Local Security Checks	high
317699	openSUSE 16 Security Update : alloy (openSUSE-SU-2026:20816-1)	Nessus	SuSE Local Security Checks	high
316992	Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2026-1747)	Nessus	Amazon Linux Local Security Checks	critical
311245	Linux Distros Unpatched Vulnerability : CVE-2026-41602	Nessus	Misc.	high

Detections

Analytics

CVE-2026-41602

high

Tenable Plugins

medium

medium

critical

high

high

critical

high