A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can serve altered versions of the Go toolchain. When selecting a different version of the Go toolchain than the currently installed toolchain (due to the GOTOOLCHAIN environment variable, or a go.work or go.mod with a toolchain line), the go command will download and execute a toolchain provided by the module proxy. A malicious module proxy can bypass checksum database validation for this downloaded toolchain. Since this vulnerability affects the security of toolchain downloads, setting GOTOOLCHAIN to a fixed version is not sufficient. You must upgrade your base Go toolchain. The go tool always validates the hash of a toolchain before executing it, so fixed versions will refuse to execute any cached, altered versions of the toolchain. The go tool trusts go.sum files to contain accurate hashes of the current module's dependencies. A malicious proxy exploiting this vulnerability to serve an altered module will have caused an incorrect hash to be recorded in the go.sum. Users who have configured a non-trusted GOPROXY can determine if they have been affected by running "rm go.sum ; go mod tidy ; go mod verify", which will revalidate all dependencies of the current module. The specific flaw in more detail: The go command consults the checksum database to validate downloaded modules, when a module is not listed in the go.sum file. It verifies that the module hash reported by the checksum database matches the hash of the downloaded module. If, however, the checksum database returns a successful response that contains no entry for the module, the go command incorrectly permitted validation to succeed. A module proxy may mirror or proxy the checksum database, in which case the go command will not connect to the checksum database directly. Checksums reported by the checksum database are cryptographically signed, so a malicious proxy cannot alter the reported checksum for a module. However, a proxy which returns an empty checksum response, or a checksum response for an unrelated module, could cause the go command to proceed as if a downloaded module has been validated.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21254-1 advisory.

    Update to go1.26.4  (bsc#1255111).

    Security issues fixed:

    - CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG (bsc#1261653).
    - CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination (bsc#1261654).
    - CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking (bsc#1261655).
    - CVE-2026-27145: crypto/x509: split candidate hostname only once (bsc#1267450).
    - CVE-2026-32280: crypto/x509: unexpected work during chain building (bsc#1261656).
    - CVE-2026-32281: crypto/x509: inefficient policy validation (bsc#1261657).
    - CVE-2026-32282: os: `Root.Chmod` can follow symlinks out of the root on Linux (bsc#1261658).
    - CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock     (bsc#1261659).
    - CVE-2026-32288: archive/tar: unbounded allocation when parsing old format GNU sparse map (bsc#1261660).
    - CVE-2026-32289: html/template: JS template literal context incorrectly tracked (bsc#1261661).
    - CVE-2026-33810: crypto/x509: excluded DNS constraints not properly applied to wildcard domains     (bsc#1261662).
    - CVE-2026-33811: net: crash when handling long `CNAME` response (bsc#1264508).
    - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad `SETTINGS_MAX_FRAME_SIZE`     (bsc#1264506).
    - CVE-2026-39817: cmd/go: `go tool pack` does not sanitize output paths (bsc#1264505).
    - CVE-2026-39819: cmd/go: `go bug` follows symlinks in predictable temporary filenames (bsc#1264504).
    - CVE-2026-39820: net/mail: quadratic string concatentation in `consumeComment` (bsc#1264503).
    - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
    - CVE-2026-39825: net/http/httputil: `ReverseProxy` forwards queries with more than `urlmaxqueryparams`     parameters       (bsc#1264500).
    - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
    - CVE-2026-39836: net: panic in `Dial` and `LookupPort` when handling `NUL` byte on Windows (bsc#1264501).
    - CVE-2026-42499: net/mail: quadratic string concatenation in `consumePhrase` (bsc#1264502).
    - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).
    - CVE-2026-42504: mime: quadratic complexity in `WordDecoder.DecodeHeader` (bsc#1267442).
    - CVE-2026-42507: net/textproto: arbitrary input is included in errors without any escaping (bsc#1267444).

    Other updates and security fixes:

    - Go packages miss `binutils-gold` dependency (bsc#1170826).
    - Drop subpackage `go1.x-libstd` `std` library `.so` refs (jsc#PED-1962).
    - Use `libalternatives` only on `suse_version >= 1610` and keep `update-alternatives` support for older       distributions.
    - Drop the `update-alternatives` migration path for `libalternatives` builds.
    - Enable `libalternatives` for SLE16.1 and Tumbleweed (bsc#1245878).
    - Drop go1.26 dependency on `update-alternatives` (bsc#1264395)
    - Update to version 1.26.3 cut from the `go1.25-fips-release` branch at the revision tagged     `go1.26.3-1-openssl-fips`       (jsc#SLE-18320).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-22121 advisory.

    [1.26.3-1.0.1]
    - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var

    [1.26.3-1]
    - Update to Go 1.26.3 (fips-1)
    - Resolves: RHEL-175607

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the go package has been released.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-22112 advisory.

    delve     [1.25.2-1.0.1]     golang     [1.25.9-1.0.1]
    - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var
    - Backported from OL9u7
    - Resolves: OLDIS-53586

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2079-1 advisory.

    This update for go1.25-openssl fixes the following issues

    Security issues:

    - CVE-2026-33811: net: crash when handling long CNAME response (bsc#1264508).
    - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE     (bsc#1264506).
    - CVE-2026-39817: cmd/go: 'go tool pack' does not sanitize output paths (bsc#1264505).
    - CVE-2026-39819: cmd/go: 'go bug' follows symlinks in predictable temporary filenames (bsc#1264504).
    - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment (bsc#1264503).
    - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
    - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams     parameters       (bsc#1264500).
    - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
    - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows (bsc#1264501).
    - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase (bsc#1264502).
    - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).

    Non security issues:

    - go1.25 release tracking (bsc#1244485).
    - Go packages miss binutils-gold dependency (bsc#1170826).
    - supply a go built with openssl linkage (jsc#SLE-18320).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2092-1 advisory.

    This update for go1.26-openssl fixes the following issues

    Security issues:

    - CVE-2026-33811: net: crash when handling long CNAME response (bsc#1264508).
    - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE     (bsc#1264506).
    - CVE-2026-39817: cmd/go: 'go tool pack' does not sanitize output paths (bsc#1264505).
    - CVE-2026-39819: cmd/go: 'go bug' follows symlinks in predictable temporary filenames (bsc#1264504).
    - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment (bsc#1264503).
    - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
    - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams     parameters       (bsc#1264500).
    - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
    - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows (bsc#1264501).
    - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase (bsc#1264502).
    - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).

    Non security issues:

    - go1.26 release tracking (bsc#1255111).
    - Go packages miss binutils-gold dependency (bsc#1170826).
    - supply a go built with openssl linkage (jsc#SLE-18320).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2093-1 advisory.

    This update for go1.25-openssl fixes the following issues

    Security issues:

    - CVE-2026-33811: net: crash when handling long CNAME response (bsc#1264508).
    - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE     (bsc#1264506).
    - CVE-2026-39817: cmd/go: 'go tool pack' does not sanitize output paths (bsc#1264505).
    - CVE-2026-39819: cmd/go: 'go bug' follows symlinks in predictable temporary filenames (bsc#1264504).
    - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment (bsc#1264503).
    - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
    - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams     parameters       (bsc#1264500).
    - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
    - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows (bsc#1264501).
    - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase (bsc#1264502).
    - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).

    Non security issues:

    - go1.25 release tracking (bsc#1244485).
    - Go packages miss binutils-gold dependency (bsc#1170826).
    - supply a go built with openssl linkage (jsc#SLE-18320).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2078-1 advisory.

    This update for go1.26-openssl fixes the following issues

    Security issues:

    - CVE-2026-33811: net: crash when handling long CNAME response (bsc#1264508).
    - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE     (bsc#1264506).
    - CVE-2026-39817: cmd/go: 'go tool pack' does not sanitize output paths (bsc#1264505).
    - CVE-2026-39819: cmd/go: 'go bug' follows symlinks in predictable temporary filenames (bsc#1264504).
    - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment (bsc#1264503).
    - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
    - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams     parameters       (bsc#1264500).
    - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
    - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows (bsc#1264501).
    - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase (bsc#1264502).
    - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).

    Non security issues:

    - go1.26 release tracking (bsc#1255111).
    - Go packages miss binutils-gold dependency (bsc#1170826).
    - supply a go built with openssl linkage (jsc#SLE-18320).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of golang installed on the remote host is prior to 1.25.10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3313 advisory.

    When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of     C memory and a crash. (CVE-2026-33811)

    When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION     frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. (CVE-2026-33814)

    The go tool pack subcommand (usually used only by the compiler as an internal tool with known-good     inputs) does not sanitize output filenames. Extracting a malicious archive file with the pack subcommand     can write files to arbitrary locations on the filesystem. (CVE-2026-39817)

    The go bug command writes to two files with predictable names in the system temporary directory (for     example, /tmp). An attacker with access to the temporary directory can create a symlink in one of these     names, causing go bug to overwrite the target of the symlink. (CVE-2026-39819)

    Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive     CPU exhaustion and memory allocations. (CVE-2026-39820)

    CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's     <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the     <content> attribute, the escaper would fail to similarly escape it, leading to XSS. (CVE-2026-39823)

    ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a     Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the     forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not     take ParseQuery's limit on the total number of query parameters (controlled by     GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a     query parameter that is not visible to the Rewrite function. For example, the query     a1=x&a2=x&...&a10000=x&hidden=y can forward the parameter hidden=y while hiding it from the proxy's     Rewrite function. (CVE-2026-39825)

    If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type'     attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed     into the <script> block. (CVE-2026-39826)

    Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC     5322. (CVE-2026-42499)

    A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass     checksum database validation. This vulnerability affects any user using an untrusted module proxy     (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can serve altered versions of the Go     toolchain. When selecting a different version of the Go toolchain than the currently installed toolchain     (due to the GOTOOLCHAIN environment variable, or a go.work or go.mod with a toolchain line), the go     command will download and execute a toolchain provided by the module proxy. A malicious module proxy can     bypass checksum database validation for this downloaded toolchain. Since this vulnerability affects the     security of toolchain downloads, setting GOTOOLCHAIN to a fixed version is not sufficient. You must     upgrade your base Go toolchain. The go tool always validates the hash of a toolchain before executing it,     so fixed versions will refuse to execute any cached, altered versions of the toolchain. The go tool trusts     go.sum files to contain accurate hashes of the current module's dependencies. A malicious proxy exploiting     this vulnerability to serve an altered module will have caused an incorrect hash to be recorded in the     go.sum. Users who have configured a non-trusted GOPROXY can determine if they have been affected by     running rm go.sum ; go mod tidy ; go mod verify, which will revalidate all dependencies of the current     module. The specific flaw in more detail: The go command consults the checksum database to validate     downloaded modules, when a module is not listed in the go.sum file. It verifies that the module hash     reported by the checksum database matches the hash of the downloaded module. If, however, the checksum     database returns a successful response that contains no entry for the module, the go command incorrectly     permitted validation to succeed. A module proxy may mirror or proxy the checksum database, in which case     the go command will not connect to the checksum database directly. Checksums reported by the checksum     database are cryptographically signed, so a malicious proxy cannot alter the reported checksum for a     module. However, a proxy which returns an empty checksum response, or a checksum response for an unrelated     module, could cause the go command to proceed as if a downloaded module has been validated.
    (CVE-2026-42501)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1743 advisory.

    When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of     C memory and a crash. (CVE-2026-33811)

    When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION     frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. (CVE-2026-33814)

    The go tool pack subcommand (usually used only by the compiler as an internal tool with known-good     inputs) does not sanitize output filenames. Extracting a malicious archive file with the pack subcommand     can write files to arbitrary locations on the filesystem. (CVE-2026-39817)

    The go bug command writes to two files with predictable names in the system temporary directory (for     example, /tmp). An attacker with access to the temporary directory can create a symlink in one of these     names, causing go bug to overwrite the target of the symlink. (CVE-2026-39819)

    Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive     CPU exhaustion and memory allocations. (CVE-2026-39820)

    CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's     <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the     <content> attribute, the escaper would fail to similarly escape it, leading to XSS. (CVE-2026-39823)

    ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a     Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the     forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not     take ParseQuery's limit on the total number of query parameters (controlled by     GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a     query parameter that is not visible to the Rewrite function. For example, the query     a1=x&a2=x&...&a10000=x&hidden=y can forward the parameter hidden=y while hiding it from the proxy's     Rewrite function. (CVE-2026-39825)

    If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type'     attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed     into the <script> block. (CVE-2026-39826)

    Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC     5322. (CVE-2026-42499)

    A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass     checksum database validation. This vulnerability affects any user using an untrusted module proxy     (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can serve altered versions of the Go     toolchain. When selecting a different version of the Go toolchain than the currently installed toolchain     (due to the GOTOOLCHAIN environment variable, or a go.work or go.mod with a toolchain line), the go     command will download and execute a toolchain provided by the module proxy. A malicious module proxy can     bypass checksum database validation for this downloaded toolchain. Since this vulnerability affects the     security of toolchain downloads, setting GOTOOLCHAIN to a fixed version is not sufficient. You must     upgrade your base Go toolchain. The go tool always validates the hash of a toolchain before executing it,     so fixed versions will refuse to execute any cached, altered versions of the toolchain. The go tool trusts     go.sum files to contain accurate hashes of the current module's dependencies. A malicious proxy exploiting     this vulnerability to serve an altered module will have caused an incorrect hash to be recorded in the     go.sum. Users who have configured a non-trusted GOPROXY can determine if they have been affected by     running rm go.sum ; go mod tidy ; go mod verify, which will revalidate all dependencies of the current     module. The specific flaw in more detail: The go command consults the checksum database to validate     downloaded modules, when a module is not listed in the go.sum file. It verifies that the module hash     reported by the checksum database matches the hash of the downloaded module. If, however, the checksum     database returns a successful response that contains no entry for the module, the go command incorrectly     permitted validation to succeed. A module proxy may mirror or proxy the checksum database, in which case     the go command will not connect to the checksum database directly. Checksums reported by the checksum     database are cryptographically signed, so a malicious proxy cannot alter the reported checksum for a     module. However, a proxy which returns an empty checksum response, or a checksum response for an unrelated     module, could cause the go command to proceed as if a downloaded module has been validated.
    (CVE-2026-42501)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1862-1 advisory.

    This update for go1.25 fixes the following issues

    Security issues:

    - CVE-2026-33811: net: crash when handling long CNAME response (bsc#1264508).
    - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE     (bsc#1264506).
    - CVE-2026-39817: cmd/go: 'go tool pack' does not sanitize output paths (bsc#1264505).
    - CVE-2026-39819: cmd/go: 'go bug' follows symlinks in predictable temporary filenames (bsc#1264504).
    - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment (bsc#1264503).
    - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
    - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams     parameters       (bsc#1264500).
    - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
    - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows (bsc#1264501).
    - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase (bsc#1264502).
    - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).

    Non security issues:

    - Updated to go1.25.10 (bsc#1244485).
    - Go packages miss binutils-gold dependency (bsc#1170826).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1861-1 advisory.

    This update for go1.26 fixes the following issues

    Security issues:

    - CVE-2026-33811: net: crash when handling long CNAME response (bsc#1264508).
    - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE     (bsc#1264506).
    - CVE-2026-39817: cmd/go: 'go tool pack' does not sanitize output paths (bsc#1264505).
    - CVE-2026-39819: cmd/go: 'go bug' follows symlinks in predictable temporary filenames (bsc#1264504).
    - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment (bsc#1264503).
    - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
    - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams     parameters       (bsc#1264500).
    - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
    - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows (bsc#1264501).
    - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase (bsc#1264502).
    - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).

    Non security issues:

    - go1.26 release tracking (bsc#1255111).
    - Go packages miss binutils-gold dependency (bsc#1170826).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Golang running on the remote host is 1.25.x prior to 1.25.10, or 1.26.x prior to 1.26.3. It is, therefore, affected by multiple vulnerabilities, including:

- The net package's LookupCNAME function could trigger a double-free crash when using the cgo DNS resolver     with very long CNAME responses. (CVE-2026-33811)  

- A symlink-handling flaw in the `go bug` command could allow an attacker to overwrite files in the system     temporary directory. (CVE-2026-39819)

  - Additional flaws affecting net, net/mail, and html/template that could be abused for denial of service or     incorrect output escaping. (CVE-2026-39836, CVE-2026-42499, CVE-2026-39820, CVE-2026-39826)   Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass
    checksum database validation. This vulnerability affects any user using an untrusted module proxy
    (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can serve altered versions of the Go
    toolchain. When selecting a different version of the Go toolchain than the currently installed toolchain
    (due to the GOTOOLCHAIN environment variable, or a go.work or go.mod with a toolchain line), the go
    command will download and execute a toolchain provided by the module proxy. A malicious module proxy can
    bypass checksum database validation for this downloaded toolchain. Since this vulnerability affects the
    security of toolchain downloads, setting GOTOOLCHAIN to a fixed version is not sufficient. You must
    upgrade your base Go toolchain. The go tool always validates the hash of a toolchain before executing it,
    so fixed versions will refuse to execute any cached, altered versions of the toolchain. The go tool trusts
    go.sum files to contain accurate hashes of the current module's dependencies. A malicious proxy exploiting
    this vulnerability to serve an altered module will have caused an incorrect hash to be recorded in the
    go.sum. Users who have configured a non-trusted GOPROXY can determine if they have been affected by
    running "rm go.sum ; go mod tidy ; go mod verify", which will revalidate all dependencies of the current
    module. The specific flaw in more detail: The go command consults the checksum database to validate
    downloaded modules, when a module is not listed in the go.sum file. It verifies that the module hash
    reported by the checksum database matches the hash of the downloaded module. If, however, the checksum
    database returns a successful response that contains no entry for the module, the go command incorrectly
    permitted validation to succeed. A module proxy may mirror or proxy the checksum database, in which case
    the go command will not connect to the checksum database directly. Checksums reported by the checksum
    database are cryptographically signed, so a malicious proxy cannot alter the reported checksum for a
    module. However, a proxy which returns an empty checksum response, or a checksum response for an unrelated
    module, could cause the go command to proceed as if a downloaded module has been validated.
    (CVE-2026-42501)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass     checksum database validation. This vulnerability affects any user using an untrusted module proxy     (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can serve altered versions of the Go     toolchain. When selecting a different version of the Go toolchain than the currently installed toolchain     (due to the GOTOOLCHAIN environment variable, or a go.work or go.mod with a toolchain line), the go     command will download and execute a toolchain provided by the module proxy. A malicious module proxy can     bypass checksum database validation for this downloaded toolchain. Since this vulnerability affects the     security of toolchain downloads, setting GOTOOLCHAIN to a fixed version is not sufficient. You must     upgrade your base Go toolchain. The go tool always validates the hash of a toolchain before executing it,     so fixed versions will refuse to execute any cached, altered versions of the toolchain. The go tool trusts     go.sum files to contain accurate hashes of the current module's dependencies. A malicious proxy exploiting     this vulnerability to serve an altered module will have caused an incorrect hash to be recorded in the     go.sum. Users who have configured a non-trusted GOPROXY can determine if they have been affected by     running rm go.sum ; go mod tidy ; go mod verify, which will revalidate all dependencies of the current     module. The specific flaw in more detail: The go command consults the checksum database to validate     downloaded modules, when a module is not listed in the go.sum file. It verifies that the module hash     reported by the checksum database matches the hash of the downloaded module. If, however, the checksum     database returns a successful response that contains no entry for the module, the go command incorrectly     permitted validation to succeed. A module proxy may mirror or proxy the checksum database, in which case     the go command will not connect to the checksum database directly. Checksums reported by the checksum     database are cryptographically signed, so a malicious proxy cannot alter the reported checksum for a     module. However, a proxy which returns an empty checksum response, or a checksum response for an unrelated     module, could cause the go command to proceed as if a downloaded module has been validated.
    (CVE-2026-42501)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
326021	openSUSE 16 Security Update : go1.26-openssl (openSUSE-SU-2026:21254-1)	Nessus	SuSE Local Security Checks	critical
322582	Oracle Linux 9 : golang (ELSA-2026-22121)	Nessus	Oracle Linux Local Security Checks	medium
320798	Photon OS 5.0: Go PHSA-2026-5.0-0869	Nessus	PhotonOS Local Security Checks	medium
318661	Oracle Linux 8 : go-toolset:ol8 (ELSA-2026-22112)	Nessus	Oracle Linux Local Security Checks	medium
317724	SUSE SLED15 / SLES15 Security Update : go1.25-openssl (SUSE-SU-2026:2079-1)	Nessus	SuSE Local Security Checks	medium
317722	SUSE SLES15 Security Update : go1.26-openssl (SUSE-SU-2026:2092-1)	Nessus	SuSE Local Security Checks	medium
317666	SUSE SLES15 Security Update : go1.25-openssl (SUSE-SU-2026:2093-1)	Nessus	SuSE Local Security Checks	medium
317661	SUSE SLED15 / SLES15 Security Update : go1.26-openssl (SUSE-SU-2026:2078-1)	Nessus	SuSE Local Security Checks	medium
316999	Amazon Linux 2 : golang, --advisory ALAS2-2026-3313 (ALAS-2026-3313)	Nessus	Amazon Linux Local Security Checks	medium
316931	Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2026-1743)	Nessus	Amazon Linux Local Security Checks	medium
315061	SUSE SLED15 / SLES15 Security Update : go1.25 (SUSE-SU-2026:1862-1)	Nessus	SuSE Local Security Checks	medium
315037	SUSE SLED15 / SLES15 Security Update : go1.26 (SUSE-SU-2026:1861-1)	Nessus	SuSE Local Security Checks	medium
314962	Golang 1.25.x < 1.25.10 / 1.26.x < 1.26.3 Multiple Vulnerabilities	Nessus	Misc.	medium
441497	Golang: stdlib: security update to 1.25.10stdlib: security update to 1.26.3	Tenable Cloud Security	Golang	high
441497	Golang: stdlib: security update to 1.25.10stdlib: security update to 1.26.3	Tenable Self-Hosted Container Security	Golang	high
313248	Linux Distros Unpatched Vulnerability : CVE-2026-42501	Nessus	Misc.	high

Detections

Analytics

CVE-2026-42501

high

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

high

high