Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a5e27945f7 advisory.

    Update to 2.112.0.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2824-1 advisory.

    This update for alloy fixes the following issues

    - CVE-2026-10722: github.com/cilium/ebpf: BTF string offset boundary check can lead to crash when parsing     malformed ELF/BTF input (bsc#1267811).
    - CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html:
    multiple issues when parsing HTML files (bsc#1267185).
    - CVE-2026-33532: Denial of Service via deeply nested YAML document parsing (bsc#1260981).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation bypass and privilege escalation (bsc#1266654).
    - CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-     39833,CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597,CVE-2026-46598:
    golang.org/x/crypto/ssh: multiple issues (bsc#1266196).
    - CVE-2026-41889: github.com/jackc/pgx/v5/internal/sanitize: SQL injection when placeholders in dollar-     quoted string literals are used in the SQL query (bsc#1265440).
    - CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to     DoS via infinite loops, panics or resource consumption (bsc#1267333).
    - CVE-2026-45678: go.opentelemetry.io/obi: Postgres BIND parsing can lead to a panic when malformed     payloads are processed (bsc#1267481).
    - CVE-2026-45682: go.opentelemetry.io/obi: keys not deleted by `CappedConcurrentHashMap` after removals     allows repeated connection churn to grow the queue without bound and exhaust heap memory (bsc#1267485).
    - CVE-2026-45685: go.opentelemetry.io/obi: MongoDB TCP parser panics on malformed wire messages and causes     a DoS (bsc#1267488).
    - CVE-2026-45686: go.opentelemetry.io/obi: integer overflow in memcached text protocol parser can crash     the OBI process and cause denial of service (bsc#1267489).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21251-1 advisory.

    Update to version 1.17.0.

    Security issues fixed:

    - CVE-2026-25680: golang.org/x/net/html: parsing arbitrary HTML can consume excessive CPU time, possibly     leading to       denial of service (bsc#1267185).
    - CVE-2026-25681: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can     result in an       unexpected HTML tree and allows for XSS (bsc#1267185).
    - CVE-2026-27136: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can     result in an       unexpected HTML tree and allows for XSS (bsc#1267185).
    - CVE-2026-33532: yaml: parsing input with deeply nestes collections may throw a `RangeError` due to a     stack overflow       and cause to a denial of service (bsc#1260981).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266654).
    - CVE-2026-39827: golang.org/x/crypto/ssh: authenticated SSH clients that repeatedly open channels which     were rejected       by the server can cause unbounded memory growth and a crash (bsc#1266196).
    - CVE-2026-39828: golang.org/x/crypto/ssh: permissions discarded when an SSH server authentication     callback returns       `PartialSuccessError` with non-`nil` permissions (bsc#1266196).
    - CVE-2026-39829: golang.org/x/crypto/ssh: unenforced size limits on key parameters by the the RSA and DSA     public key       parsers can lead to excessive CPU consumption when processing a crafted public key (bsc#1266196).
    - CVE-2026-39830: golang.org/x/crypto/ssh: malicious SSH peers sending unsolicited global request     responses can block a       connection's read loop and cause a resource leak (bsc#1266196).
    - CVE-2026-39831: golang.org/x/crypto/ssh: missing `User Presence` flag checks in the `Verify()` method     for FIDO/U2F       security key types cause signatures generated without physical touch to be accepted (bsc#1266196).
    - CVE-2026-39832: golang.org/x/crypto/ssh: destination restrictions are silently stripped when forwarding     keys and       allow for unrestricted use of a key on a remote host (bsc#1266196).
    - CVE-2026-39833: golang.org/x/crypto/ssh: in-memory keyring returned by `NewKeyring()` silently accepts     keys with the       `ConfirmBeforeUse` constraint but never enforces it (bsc#1266196).
    - CVE-2026-39834: golang.org/x/crypto/ssh: writing data larger than 4GB in a single `Write` call on an SSH     channel       leads to an integer overflow and an infinite loop that sends empty packets (bsc#1266196).
    - CVE-2026-39835: golang.org/x/crypto/ssh: processing of certificates by SSH servers using `CertChecker`     as a public       key callback without setting `IsUserAuthority` or `IsHostAuthority` can lead to a panic (bsc#1266196).
    - CVE-2026-41889: github.com/jackc/pgx/v5/internal/sanitize: use placeholders in dollar-quoted string     literals in an       SQL query can lead to a SQL injection (bsc#1265440).
    - CVE-2026-42502: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can     result in an       unexpected HTML tree and allows for XSS (bsc#1267185).
    - CVE-2026-42506: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can     result in an       unexpected HTML tree and allows for XSS (bsc#1267185).
    - CVE-2026-42508: golang.org/x/crypto/ssh: revoked `SignatureKey`s belonging to a CA are not correctly     checked for       revocation (bsc#1266196).
    - CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to     DoS via       infinite loops, panics or resource consumption (bsc#1267333).
    - CVE-2026-45678: go.opentelemetry.io/obi: Postgres BIND parsing can lead to a panic when malformed     payloads are       processed (bsc#1267481).
    - CVE-2026-45682: go.opentelemetry.io/obi: keys not deleted by `CappedConcurrentHashMap` after removals     allows repeated       connection churn to grow the queue without bound and exhaust heap memory (bsc#1267485).
    - CVE-2026-45685: go.opentelemetry.io/obi: MongoDB TCP parser panics on malformed wire messages and causes     a DoS       (bsc#1267488).
    - CVE-2026-45686: go.opentelemetry.io/obi: integer overflow in memcached text protocol parser can crash     the OBI process       and cause denial of service (bsc#1267489).
    - CVE-2026-46595: golang.org/x/crypto/ssh: source-address validation is skipped if any other type of     callback is passed       other than public key (bsc#1266196).
    - CVE-2026-46597: golang.org/x/crypto/ssh: incorrectly placed cast from bytes to int in the AES-GCM packet     decoder when       processing specially crafted input can lead to for server-side panic (bsc#1266196).
    - CVE-2026-46598: golang.org/x/crypto/ssh: `ed25519.PrivateKey` created by casting malformed wire bytes     due to       processing of certain crafted inputs can lead to panic when used (bsc#1266196).

    Other updates and bugfixes:

    - Version 1.17.0:
      * Features
        * Add GraphQL server and `gql` subcommand.
        * `otelcol`: Add Nginx receiver.
        * `otelcol.exporter.prometheus`: Convert classic histograms to NHCB.
        * `database_observability`: Various enhancements for MySQL and Postgres.
        * `faro.receiver`: Support gzip-compressed request bodies.
        * Update to Beyla 3.9.8.
     * Bug Fixes
       * security: Update `x/crypto`, `x/net`, `jackc/pgx/v5`, and `obi`.
       * cluster: Fix nodes failing to join the cluster with TLS enabled.
       * `loki.process`: Fix potential deadlocks and limit stage shutdown.
       * Update Go to v1.26.4.
    - Version 1.16.3:
      * cluster: Fix nodes failing to join the cluster when TLS is enabled.
    - Version 1.16.2:
      * `loki.process`: No longer mutate rules in `stage.truncate` causing every config update to reload     pipeline when this         stage is used.
      * `loki.process`: Potential deadlock on update with stage and receiver changes.
      * `otelcol.exporter.awss3`: Add missing `unique_key_func_name` attribute.
    - Remove dependency on vulnerable `yaml` library.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21072-1 advisory.

    This update for trivy fixes the following issues

    Update to version 0.71.2:

    - CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to     DoS via infinite       loops, panics or resource consumption (bsc#1267268).
    - CVE-2026-46680: github.com/containerd/containerd/v2/pkg/oci: containerd user ID handling bypass allows     runAsNonRoot       evasion (bsc#1268356).
    - CVE-2026-47262: github.com/containerd/containerd/v2/pkg/oci: Denial of Service (DoS) condition via a     maliciously       crafted image (bsc#1268440).
    - CVE-2026-50195: containerd: fails to validate the image references specified within a checkpoint image's       configuration (bsc#1268399).
    - CVE-2026-53488: containerd: CRI plugin propagates labels from an image config to a container without     validation       (bsc#1268400).
    - CVE-2026-53489: containerd: CRI plugin restores container.log from a checkpoint image without validating     a symlinked       path (bsc#1268404).
    - CVE-2026-53492: containerd: improperly trusts Container Device Interface (CDI) annotations found within     untrusted       checkpoint image metadata during container restoration (bsc#1268403).

    Changes for trivy:

     * release: v0.71.2 [release/v0.71] (#10871)
     * fix(deps): bump alpine to 3.24.1 [backport: release/v0.71] (#10870)
     * chore(deps): bump the common group with 4 updates [backport: release/v0.71] (#10867)
     * fix(oci): validate artifact filename
     * fix: forward ospkg detector options through ospkg.NewScanner
     * fix(vex): load VEX documents from within the repository        directory
     * fix: surface the original analysis error instead of context        cancellation
     * ci: expect GitHub App bot as backport PR author

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2468-1 advisory.

    This update for amazon-ssm-agent fixes the following issues

    Update to version 3.3.4624.0:

    - CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of     golang.org/x/crypto/ssh       (bsc#1239342).
    - CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
    - CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected     message type in       response to a key listing or signing request (bsc#1253611).
    - CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for     specific inputs       (bsc#1265474).
    - CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack     and .idx files       can lead to the consumption of corrupted files (bsc#1258095).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege esca (bsc#1266781).
    - CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following     redirects during       smart-HTTP clone and fetch operations (bsc#1264952).
    - CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to     DoS via infinite       loops, panics or resource consumption (bsc#1267332).
    - CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
    - CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in     golang.org/x/crypto/ssh       (bsc#1266200).
    - CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in     golang.org/x/crypto/ssh       (bsc#1266200).
    - CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent       (bsc#1266200).
    - CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
    - CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
    - CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in     golang.org/x/crypto/ssh/knownhosts       (bsc#1266200).
    - CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in     golang.org/x/crypto/ssh       (bsc#1266200).
    - CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent     (bsc#1266200).

    Changes:

     * Bump golang.org/x/crypto from v0.51.0 to v0.52.0
     * Bump golang.org/x/net from v0.54.0 to v0.55.0
     * Enforce directory boundary in BuildSafePath
     * Fix visibility issue with Bottlerocket OS in document output
     * Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this        also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
     * Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
     * Quit if sysprep failed and log its current state
     * Remove attached legacy cloudwatch plugin packages
     * Upgrade Go version to 1.25.10
     * Use BuildSafePath wherever it is applicable
     * Add OOM killer protection to systemd service files
     * Apply more sanitation to file and registry inventory gatherers
     * Bump go-git to v5.17.1
     * Deprecate legacy cloudwatch plugin
     * Preserve network error details in credential refresher SSM API failures
     * Upgrade Go version to 1.25.9
     * Add SSM Distributor support for Bottlerocket OS
     * Implement flush credentials command in ssm-cli
     * Log ec2messages access denied as debug instead of error to reduce log noise
     * Make credential refresher refresh cache quickly in case of credential flush
     * Make Greengrass component registration resilient with retry
     * Add EnforceWorkspaceRootOwnership configuration to support disable        hardening of agent workspace
     * Add reboot comment to Windows shutdown command for SSM Agent traceability
     * Update privilege access check to verify ownership and permissions        of document state files
     * Add read-only version check prior to install and uninstall        in case of occupied package manager locks
     * Add ANSI processing for CloudWatch and S3 log
     * Upgrade go-git to v5.17.0 and cloudflare/circl to v1.6.3        to fix CVE-2026-1229
    - Switch to systemd-tmpfiles to store runtime data (jsc#PED-14843)
     * Disable Go 1.25 container-aware GOMAXPROCS to prevent holding        cgroup file descriptors open
     * Upgrade Go version to 1.25.8
     * Document CommandWorkerBufferLimit config
     * Include package update in Dockerfile
     * Reduce CloudWatch event message length threshold
     * Upgrade Go version to 1.25.7
     * Update github.com/go-git/go-git/v5 to 5.16.5 (bsc#1258095, CVE-2026-25934)
     * Update greengrass version
     * Update Golang version to 1.24.12
     * Updating golang.org/x/crypto from v0.37.0 to v0.47.0, golang.org/x/net        from v0.39.0 to v0.48.0 and golang.org/x/sys from v0.32.0 to v0.40.0        (bsc#1253611, CVE-2025-47913)
     * Categorize integration tests by adding new tags to split fast and slow ones
     * Fix bug where IP field being empty string and causing UII API failure
     * Allow Patch execution to persist across reboots not registered to SSM Agent
     * Fix ENV_VAR interpolation to work correctly with parameter store value
     * Implement immediate retries for failed reply messages to MGS for RunCommand documents
     * Improve ssm-cli get-diagnostics command log output
     * Support DomainJoin endpoint for EU sovereign cloud
     * Support dualstack S3 endpoint for distributor packages
     * Upgrade Go version to 1.24.11
     * Add initial IPv6 support with UseDualStackEndpoint configuration option
     * Fix CPU utilization issue for instances with thousands of network interfaces
     * Add IMDS retry count to account for EC2 droplet refresh
     * Fix duplicate uid error logging in MDS module
     * Update aws:Domainjoin plugin logging from Log4Net to NLog
     * Upgrade Go version to 1.24.7
     * Update github.com/go-git/go-git/v5 to 5.15.0
     * Update golang.org/x/crypto to v0.37.0 (bsc#1238702, CVE-2025-22870)
     * Update golang.org/x/net to v0.39.0
     * Update golang.org/x/sys to v0.32.0
     * Add EU sovereign cloud S3 endpoint for DownloadContent plugin
     * Add configurable credential rotation max backoff interval
     * Migrate from twinj/uuid to google/uuid library
     * Allow newer agent versions to be installed when deploying on Greengrass
     * Harden function to remove non-admin run command documents in execution path
     * Fix macOS credential refresher test issue due to missing Debugf from serialport skip file
     * Enhance testability of custom certificate usage in debug SSM Agent builds
     * Decouple serial port from startup and add credential refresher serialport logging
     * Add GlobalEnhancedTelemetryEnabled config to README
     * Add cloudwatch logs endpoint configuration to optional config for agent
     * Update Greengrass component version
     * Add file privilege check before processing document state file
     * Storing AWS document interpolation ENV_VAR types as environment variables
     * Throw explicit error when running local cli as non-priviledged user
     * Harden telemetry dynamic config folder permissions
     * Add configuration option for HandshakeTimeout
     * Improve unit tests
     * Add setup for emitting telemetry logs and metrics
     * Add initial selection of error logs to emit to telemetry
     * Simplify checkstyle and import organization in build scripts
     * Update golang.org/x/net from v0.37.0 to v0.38.0
     * Agent hibernation reason is logged to EC2 system logs
     * Add metrics for the EC2Detector and IMDS EC2 status findings
     * Change Linux DomainJoin plugin parameter KeepHostName to accept        both boolean and string
     * Upgrade GoLang to version 1.23.8
     * Update golang.org/x/crypto from v0.32.0 to v0.36.0 (bsc#1239342, CVE-2025-22869)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2467-1 advisory.

    This update for amazon-ssm-agent fixes the following issues

    Update to version 3.3.4624.0:

    - CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of     golang.org/x/crypto/ssh       (bsc#1239342).
    - CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
    - CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected     message type in       response to a key listing or signing request (bsc#1253611).
    - CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for     specific inputs       (bsc#1265474).
    - CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack     and .idx files       can lead to the consumption of corrupted files (bsc#1258095).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege esca (bsc#1266781).
    - CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following     redirects during       smart-HTTP clone and fetch operations (bsc#1264952).
    - CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to     DoS via infinite       loops, panics or resource consumption (bsc#1267332).
    - CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
    - CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in     golang.org/x/crypto/ssh       (bsc#1266200).
    - CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in     golang.org/x/crypto/ssh       (bsc#1266200).
    - CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent       (bsc#1266200).
    - CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
    - CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
    - CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in     golang.org/x/crypto/ssh/knownhosts       (bsc#1266200).
    - CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in     golang.org/x/crypto/ssh       (bsc#1266200).
    - CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent     (bsc#1266200).

    Changes:

     * Bump golang.org/x/crypto from v0.51.0 to v0.52.0
     * Bump golang.org/x/net from v0.54.0 to v0.55.0
     * Enforce directory boundary in BuildSafePath
     * Fix visibility issue with Bottlerocket OS in document output
     * Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this        also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
     * Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
     * Quit if sysprep failed and log its current state
     * Remove attached legacy cloudwatch plugin packages
     * Upgrade Go version to 1.25.10
     * Use BuildSafePath wherever it is applicable
     * Add OOM killer protection to systemd service files
     * Apply more sanitation to file and registry inventory gatherers
     * Bump go-git to v5.17.1
     * Deprecate legacy cloudwatch plugin
     * Preserve network error details in credential refresher SSM API failures
     * Upgrade Go version to 1.25.9
     * Add SSM Distributor support for Bottlerocket OS
     * Implement flush credentials command in ssm-cli
     * Log ec2messages access denied as debug instead of error to reduce log noise
     * Make credential refresher refresh cache quickly in case of credential flush
     * Make Greengrass component registration resilient with retry
     * Add EnforceWorkspaceRootOwnership configuration to support disable        hardening of agent workspace
     * Add reboot comment to Windows shutdown command for SSM Agent traceability
     * Update privilege access check to verify ownership and permissions        of document state files
     * Add read-only version check prior to install and uninstall        in case of occupied package manager locks
     * Add ANSI processing for CloudWatch and S3 log
     * Upgrade go-git to v5.17.0 and cloudflare/circl to v1.6.3        to fix CVE-2026-1229
    - Switch to systemd-tmpfiles to store runtime data (jsc#PED-14843)
     * Disable Go 1.25 container-aware GOMAXPROCS to prevent holding        cgroup file descriptors open
     * Upgrade Go version to 1.25.8
     * Document CommandWorkerBufferLimit config
     * Include package update in Dockerfile
     * Reduce CloudWatch event message length threshold
     * Upgrade Go version to 1.25.7
     * Update github.com/go-git/go-git/v5 to 5.16.5 (bsc#1258095, CVE-2026-25934)
     * Update greengrass version
     * Update Golang version to 1.24.12
     * Updating golang.org/x/crypto from v0.37.0 to v0.47.0, golang.org/x/net        from v0.39.0 to v0.48.0 and golang.org/x/sys from v0.32.0 to v0.40.0        (bsc#1253611, CVE-2025-47913)
     * Categorize integration tests by adding new tags to split fast and slow ones
     * Fix bug where IP field being empty string and causing UII API failure
     * Allow Patch execution to persist across reboots not registered to SSM Agent
     * Fix ENV_VAR interpolation to work correctly with parameter store value
     * Implement immediate retries for failed reply messages to MGS for RunCommand documents
     * Improve ssm-cli get-diagnostics command log output
     * Support DomainJoin endpoint for EU sovereign cloud
     * Support dualstack S3 endpoint for distributor packages
     * Upgrade Go version to 1.24.11
     * Add initial IPv6 support with UseDualStackEndpoint configuration option
     * Fix CPU utilization issue for instances with thousands of network interfaces
     * Add IMDS retry count to account for EC2 droplet refresh
     * Fix duplicate uid error logging in MDS module
     * Update aws:Domainjoin plugin logging from Log4Net to NLog
     * Upgrade Go version to 1.24.7
     * Update github.com/go-git/go-git/v5 to 5.15.0
     * Update golang.org/x/crypto to v0.37.0 (bsc#1238702, CVE-2025-22870)
     * Update golang.org/x/net to v0.39.0
     * Update golang.org/x/sys to v0.32.0
     * Add EU sovereign cloud S3 endpoint for DownloadContent plugin
     * Add configurable credential rotation max backoff interval
     * Migrate from twinj/uuid to google/uuid library
     * Allow newer agent versions to be installed when deploying on Greengrass
     * Harden function to remove non-admin run command documents in execution path
     * Fix macOS credential refresher test issue due to missing Debugf from serialport skip file
     * Enhance testability of custom certificate usage in debug SSM Agent builds
     * Decouple serial port from startup and add credential refresher serialport logging
     * Add GlobalEnhancedTelemetryEnabled config to README
     * Add cloudwatch logs endpoint configuration to optional config for agent
     * Update Greengrass component version
     * Add file privilege check before processing document state file
     * Storing AWS document interpolation ENV_VAR types as environment variables
     * Throw explicit error when running local cli as non-priviledged user
     * Harden telemetry dynamic config folder permissions
     * Add configuration option for HandshakeTimeout
     * Improve unit tests
     * Add setup for emitting telemetry logs and metrics
     * Add initial selection of error logs to emit to telemetry
     * Simplify checkstyle and import organization in build scripts
     * Update golang.org/x/net from v0.37.0 to v0.38.0
     * Agent hibernation reason is logged to EC2 system logs
     * Add metrics for the EC2Detector and IMDS EC2 status findings
     * Change Linux DomainJoin plugin parameter KeepHostName to accept        both boolean and string
     * Upgrade GoLang to version 1.23.8
     * Update golang.org/x/crypto from v0.32.0 to v0.36.0 (bsc#1239342, CVE-2025-22869)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20956-1 advisory.

    This update for trivy fixes the following issues

    - CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html:
    multiple issues       when parsing HTML files (bsc#1267047).
    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265648).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266495).
    - CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh     (bsc#1266075).
    - CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266075).
    - CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh     (bsc#1266075).
    - CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in     golang.org/x/crypto/ssh       (bsc#1266075).
    - CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in     golang.org/x/crypto/ssh       (bsc#1266075).
    - CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent       (bsc#1266075).
    - CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266075).
    - CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266075).
    - CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh     (bsc#1266075).
    - CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in     golang.org/x/crypto/ssh/knownhosts       (bsc#1266075).
    - CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in     golang.org/x/crypto/ssh       (bsc#1266075).
    - CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh     (bsc#1266075).
    - CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent     (bsc#1266075).
    - CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to     DoS via infinite       loops, panics or resource consumption (bsc#1267268).

    Changes for trivy:

    - Update to version 0.71.0 (bsc#1267268, CVE-2026-44740):
     * release: v0.71.0 [main] (#10638)
     * ci: use only the first line of commit message in release-please workflow (#10766)
     * feat: add WithDriver and WithProvider options to ospkg detector (#10740)
     * chore(deps): bump github.com/google/go-containerregistry to v0.21.6 (#10741)
     * refactor(secret): normalize configPath once in Init (#10702)
     * feat(secret): add Maven rules to detect passwords and passphrases in settings.xml and settings-     security.xml        files (#10704)
     * chore(deps): bump the common group across 1 directory with 25 updates (#10758)
     * chore: migrate from gomodguard to gomodguard_v2 (#10739)
     * chore(deps): bump the docker group across 1 directory with 2 updates (#10709)
     * chore(deps): bump github.com/aws/aws-sdk-go-v2/service/ec2 from 1.302.0 to 1.303.0 in the aws group     (#10752)
     * ci: scope GitHub App tokens to minimum required permissions (#10755)
     * chore(deps): upgrade go-redis from v8 to v9 (#10736)
     * fix(misconf): fix rendering of nested values in terraform plan lists (#10746)
     * fix(misconf): skip resources with no after changes (#10352)
     * fix(misconf): reject nil plays during playbook parsing (#10273)
     * fix(nodejs): silently skip subdirectory package.json files with invalid names (#10609)
     * fix(misconf): skip null cty values in AsMapValue to prevent panic (#10723)
     * refactor(misconf): replace custom Helm archive parsing with Helm SDK loaders (#10718)
     * chore(deps): bump github.com/containerd/containerd/v2 to v2.3.1 (#10738)
     * chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 (#10686)
     * fix(report): don't produce trailing comma in gitlab.tpl links array (#10728)
     * fix(cloudformation): propagate AWS::EC2::Instance MetadataOptions (#10731)
     * chore(deps): upgrade github.com/cenkalti/backoff dependency to v5 (#10705)
     * chore: bump golangci-lint to v2.12 (#10726)
     * feat(spdx): add SHA-512 hash algorithm support to SPDX serializer (#10719)
     * feat(sbom): support for CycloneDX 1.7 (#10715)
     * chore(deps): bump github.com/aws/aws-sdk-go-v2/service/ec2 from 1.300.0 to 1.302.0 in the aws group     (#10708)
     * chore: migrate from helm.sh/helm/v3 to helm.sh/helm/v4 (#10678)
     * fix(image): correctly reconstruct RUN instructions built without BuildKit (#10714)
     * feat(java): support <mirrors> from settings.xml (#10692)
     * fix(java): surface 429 from a remote Maven repository as a fatal error when scanning pom.xml files     (#10693)
     * chore: bump go to 1.26.3 (#10683)
     * fix(nodejs): handle legacy license formats in npm lockfile parser (#10684)
     * fix(secret): correctly skip secret-scanner config file from scanning (#10666)
     * feat(ubuntu): detect Ubuntu 26.04 LTS (#10592)
     * refactor(nodejs): deduplicate license traversal across package managers (#10681)
     * fix: overwrite OS packages PURLs after overwrite OS (#10298)
     * feat(secret): add Azure secret detection rules (#10562)
     * fix(misconf): prevent path traversal in Terraform filesystem functions (#10664)
     * feat(secret): add a way to customize skipped folders, files and exts (#10550)
     * ci: migrate PAT tokens to GitHub App (#10628)
     * chore(deps): bump the aws group across 1 directory with 6 updates (#10598)
     * chore(deps): bump the docker group across 1 directory with 3 updates (#10596)
     * chore(deps): bump the github-actions group across 2 directories with 9 updates (#10608)
     * chore(deps): bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 (#10641)
     * chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 (#10648)
     * ci: migrate PAT tokens to GITHUB_TOKEN for reusable-release workflow (#10655)
     * feat(seal): add vendor support for language file detection. (#10297)
     * fix(misconf): make identifiers in ignore rules case-insensitive (#10375)
     * fix: pull instead of clone when test repo already exists (#10636)
     * docs: document how to disable check.trivy.dev connections (#10623)
     * docs(misconf): fix typo in misconfiguration config (#10619)
     * ci: remove secrets from run block (#10590)
     * docs: fix typos (#10605)
     * refactor(deps): replace archived go-homedir with os.UserHomeDir (#10484)
     * chore(deps): Bump `go-ini` and fix the import path. (#10489)
     * chore(deps): bump the github-actions group across 2 directories with 9 updates (#10495)
     * chore(deps): bump github.com/aquasecurity/testdocker (#10543)
     * docs: convert README demonstration videos to mp4 (#10419)
     * chore(deps): upgrade vm scan dependency for bug fix (#10575)
     * docs(nodejs): clarify package.json behavior in image scanning (#10572)
     * chore(deps): replace xeipuuv/gojsonschema and invopop/jsonschema with google/jsonschema-go (#10528)
     * chore(deps): bump github.com/go-git/go-git/v5 from 5.17.2 to 5.18.0 (#10554)
     * chore(deps): bump alpine to 3.23.4 (#10552)
     * ci(helm): bump Trivy version to 0.70.0 for Trivy Helm Chart 0.22.0 (#10547)
    - update x/net to v0.55.0 (      bsc#1266495, CVE-2026-39821      bsc#1267047, CVE-2026-25680,      CVE-2026-42502,      CVE-2026-27136,      CVE-2026-25681,      CVE-2026-42506)
    - update x/crypto to 0.52.0 (bsc#1266075, CVE-2026-39827,      CVE-2026-39834,CVE-2026-39828,CVE-2026-39829,CVE-2026-39831,      CVE-2026-42508,CVE-2026-39833,CVE-2026-39830,CVE-2026-39832,      CVE-2026-46597,CVE-2026-46598,CVE-2026-46595,CVE-2026-39835)      bsc#1265648, CVE-2026-33814,

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple     components may improperly handle crafted or malformed input, resulting in panics, infinite loops,     uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation     and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of     unexpected states when processing untrusted repository data and filesystem structures. This issue has been     patched in versions 5.9.0 and 6.0.0-alpha.1. (CVE-2026-44740)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
326362	Fedora 44 : jfrog-cli (2026-a5e27945f7)	Nessus	Fedora Local Security Checks	high
326329	SUSE SLED15 / SLES15 Security Update : alloy (SUSE-SU-2026:2824-1)	Nessus	SuSE Local Security Checks	medium
326022	openSUSE 16 Security Update : alloy (openSUSE-SU-2026:21251-1)	Nessus	SuSE Local Security Checks	low
324052	openSUSE 16 Security Update : trivy (openSUSE-SU-2026:21072-1)	Nessus	SuSE Local Security Checks	critical
321922	SUSE SLES12 Security Update : amazon-ssm-agent (SUSE-SU-2026:2468-1)	Nessus	SuSE Local Security Checks	medium
321917	SUSE SLES15 Security Update : amazon-ssm-agent (SUSE-SU-2026:2467-1)	Nessus	SuSE Local Security Checks	medium
321461	openSUSE 16 Security Update : trivy (openSUSE-SU-2026:20956-1)	Nessus	SuSE Local Security Checks	high
318167	Linux Distros Unpatched Vulnerability : CVE-2026-44740	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-44740

medium

Tenable Plugins

high

medium

low

critical

medium

medium

high

medium