Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2468-1 advisory.

    This update for amazon-ssm-agent fixes the following issues

    Update to version 3.3.4624.0:

    - CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of     golang.org/x/crypto/ssh       (bsc#1239342).
    - CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
    - CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected     message type in       response to a key listing or signing request (bsc#1253611).
    - CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for     specific inputs       (bsc#1265474).
    - CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack     and .idx files       can lead to the consumption of corrupted files (bsc#1258095).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege esca (bsc#1266781).
    - CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following     redirects during       smart-HTTP clone and fetch operations (bsc#1264952).
    - CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to     DoS via infinite       loops, panics or resource consumption (bsc#1267332).
    - CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
    - CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in     golang.org/x/crypto/ssh       (bsc#1266200).
    - CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in     golang.org/x/crypto/ssh       (bsc#1266200).
    - CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent       (bsc#1266200).
    - CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
    - CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
    - CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in     golang.org/x/crypto/ssh/knownhosts       (bsc#1266200).
    - CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in     golang.org/x/crypto/ssh       (bsc#1266200).
    - CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent     (bsc#1266200).

    Changes:

     * Bump golang.org/x/crypto from v0.51.0 to v0.52.0
     * Bump golang.org/x/net from v0.54.0 to v0.55.0
     * Enforce directory boundary in BuildSafePath
     * Fix visibility issue with Bottlerocket OS in document output
     * Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this        also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
     * Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
     * Quit if sysprep failed and log its current state
     * Remove attached legacy cloudwatch plugin packages
     * Upgrade Go version to 1.25.10
     * Use BuildSafePath wherever it is applicable
     * Add OOM killer protection to systemd service files
     * Apply more sanitation to file and registry inventory gatherers
     * Bump go-git to v5.17.1
     * Deprecate legacy cloudwatch plugin
     * Preserve network error details in credential refresher SSM API failures
     * Upgrade Go version to 1.25.9
     * Add SSM Distributor support for Bottlerocket OS
     * Implement flush credentials command in ssm-cli
     * Log ec2messages access denied as debug instead of error to reduce log noise
     * Make credential refresher refresh cache quickly in case of credential flush
     * Make Greengrass component registration resilient with retry
     * Add EnforceWorkspaceRootOwnership configuration to support disable        hardening of agent workspace
     * Add reboot comment to Windows shutdown command for SSM Agent traceability
     * Update privilege access check to verify ownership and permissions        of document state files
     * Add read-only version check prior to install and uninstall        in case of occupied package manager locks
     * Add ANSI processing for CloudWatch and S3 log
     * Upgrade go-git to v5.17.0 and cloudflare/circl to v1.6.3        to fix CVE-2026-1229
    - Switch to systemd-tmpfiles to store runtime data (jsc#PED-14843)
     * Disable Go 1.25 container-aware GOMAXPROCS to prevent holding        cgroup file descriptors open
     * Upgrade Go version to 1.25.8
     * Document CommandWorkerBufferLimit config
     * Include package update in Dockerfile
     * Reduce CloudWatch event message length threshold
     * Upgrade Go version to 1.25.7
     * Update github.com/go-git/go-git/v5 to 5.16.5 (bsc#1258095, CVE-2026-25934)
     * Update greengrass version
     * Update Golang version to 1.24.12
     * Updating golang.org/x/crypto from v0.37.0 to v0.47.0, golang.org/x/net        from v0.39.0 to v0.48.0 and golang.org/x/sys from v0.32.0 to v0.40.0        (bsc#1253611, CVE-2025-47913)
     * Categorize integration tests by adding new tags to split fast and slow ones
     * Fix bug where IP field being empty string and causing UII API failure
     * Allow Patch execution to persist across reboots not registered to SSM Agent
     * Fix ENV_VAR interpolation to work correctly with parameter store value
     * Implement immediate retries for failed reply messages to MGS for RunCommand documents
     * Improve ssm-cli get-diagnostics command log output
     * Support DomainJoin endpoint for EU sovereign cloud
     * Support dualstack S3 endpoint for distributor packages
     * Upgrade Go version to 1.24.11
     * Add initial IPv6 support with UseDualStackEndpoint configuration option
     * Fix CPU utilization issue for instances with thousands of network interfaces
     * Add IMDS retry count to account for EC2 droplet refresh
     * Fix duplicate uid error logging in MDS module
     * Update aws:Domainjoin plugin logging from Log4Net to NLog
     * Upgrade Go version to 1.24.7
     * Update github.com/go-git/go-git/v5 to 5.15.0
     * Update golang.org/x/crypto to v0.37.0 (bsc#1238702, CVE-2025-22870)
     * Update golang.org/x/net to v0.39.0
     * Update golang.org/x/sys to v0.32.0
     * Add EU sovereign cloud S3 endpoint for DownloadContent plugin
     * Add configurable credential rotation max backoff interval
     * Migrate from twinj/uuid to google/uuid library
     * Allow newer agent versions to be installed when deploying on Greengrass
     * Harden function to remove non-admin run command documents in execution path
     * Fix macOS credential refresher test issue due to missing Debugf from serialport skip file
     * Enhance testability of custom certificate usage in debug SSM Agent builds
     * Decouple serial port from startup and add credential refresher serialport logging
     * Add GlobalEnhancedTelemetryEnabled config to README
     * Add cloudwatch logs endpoint configuration to optional config for agent
     * Update Greengrass component version
     * Add file privilege check before processing document state file
     * Storing AWS document interpolation ENV_VAR types as environment variables
     * Throw explicit error when running local cli as non-priviledged user
     * Harden telemetry dynamic config folder permissions
     * Add configuration option for HandshakeTimeout
     * Improve unit tests
     * Add setup for emitting telemetry logs and metrics
     * Add initial selection of error logs to emit to telemetry
     * Simplify checkstyle and import organization in build scripts
     * Update golang.org/x/net from v0.37.0 to v0.38.0
     * Agent hibernation reason is logged to EC2 system logs
     * Add metrics for the EC2Detector and IMDS EC2 status findings
     * Change Linux DomainJoin plugin parameter KeepHostName to accept        both boolean and string
     * Upgrade GoLang to version 1.23.8
     * Update golang.org/x/crypto from v0.32.0 to v0.36.0 (bsc#1239342, CVE-2025-22869)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2467-1 advisory.

    This update for amazon-ssm-agent fixes the following issues

    Update to version 3.3.4624.0:

    - CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of     golang.org/x/crypto/ssh       (bsc#1239342).
    - CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
    - CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected     message type in       response to a key listing or signing request (bsc#1253611).
    - CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for     specific inputs       (bsc#1265474).
    - CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack     and .idx files       can lead to the consumption of corrupted files (bsc#1258095).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege esca (bsc#1266781).
    - CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following     redirects during       smart-HTTP clone and fetch operations (bsc#1264952).
    - CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to     DoS via infinite       loops, panics or resource consumption (bsc#1267332).
    - CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
    - CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in     golang.org/x/crypto/ssh       (bsc#1266200).
    - CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in     golang.org/x/crypto/ssh       (bsc#1266200).
    - CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent       (bsc#1266200).
    - CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
    - CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
    - CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in     golang.org/x/crypto/ssh/knownhosts       (bsc#1266200).
    - CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in     golang.org/x/crypto/ssh       (bsc#1266200).
    - CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh     (bsc#1266200).
    - CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent     (bsc#1266200).

    Changes:

     * Bump golang.org/x/crypto from v0.51.0 to v0.52.0
     * Bump golang.org/x/net from v0.54.0 to v0.55.0
     * Enforce directory boundary in BuildSafePath
     * Fix visibility issue with Bottlerocket OS in document output
     * Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this        also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
     * Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
     * Quit if sysprep failed and log its current state
     * Remove attached legacy cloudwatch plugin packages
     * Upgrade Go version to 1.25.10
     * Use BuildSafePath wherever it is applicable
     * Add OOM killer protection to systemd service files
     * Apply more sanitation to file and registry inventory gatherers
     * Bump go-git to v5.17.1
     * Deprecate legacy cloudwatch plugin
     * Preserve network error details in credential refresher SSM API failures
     * Upgrade Go version to 1.25.9
     * Add SSM Distributor support for Bottlerocket OS
     * Implement flush credentials command in ssm-cli
     * Log ec2messages access denied as debug instead of error to reduce log noise
     * Make credential refresher refresh cache quickly in case of credential flush
     * Make Greengrass component registration resilient with retry
     * Add EnforceWorkspaceRootOwnership configuration to support disable        hardening of agent workspace
     * Add reboot comment to Windows shutdown command for SSM Agent traceability
     * Update privilege access check to verify ownership and permissions        of document state files
     * Add read-only version check prior to install and uninstall        in case of occupied package manager locks
     * Add ANSI processing for CloudWatch and S3 log
     * Upgrade go-git to v5.17.0 and cloudflare/circl to v1.6.3        to fix CVE-2026-1229
    - Switch to systemd-tmpfiles to store runtime data (jsc#PED-14843)
     * Disable Go 1.25 container-aware GOMAXPROCS to prevent holding        cgroup file descriptors open
     * Upgrade Go version to 1.25.8
     * Document CommandWorkerBufferLimit config
     * Include package update in Dockerfile
     * Reduce CloudWatch event message length threshold
     * Upgrade Go version to 1.25.7
     * Update github.com/go-git/go-git/v5 to 5.16.5 (bsc#1258095, CVE-2026-25934)
     * Update greengrass version
     * Update Golang version to 1.24.12
     * Updating golang.org/x/crypto from v0.37.0 to v0.47.0, golang.org/x/net        from v0.39.0 to v0.48.0 and golang.org/x/sys from v0.32.0 to v0.40.0        (bsc#1253611, CVE-2025-47913)
     * Categorize integration tests by adding new tags to split fast and slow ones
     * Fix bug where IP field being empty string and causing UII API failure
     * Allow Patch execution to persist across reboots not registered to SSM Agent
     * Fix ENV_VAR interpolation to work correctly with parameter store value
     * Implement immediate retries for failed reply messages to MGS for RunCommand documents
     * Improve ssm-cli get-diagnostics command log output
     * Support DomainJoin endpoint for EU sovereign cloud
     * Support dualstack S3 endpoint for distributor packages
     * Upgrade Go version to 1.24.11
     * Add initial IPv6 support with UseDualStackEndpoint configuration option
     * Fix CPU utilization issue for instances with thousands of network interfaces
     * Add IMDS retry count to account for EC2 droplet refresh
     * Fix duplicate uid error logging in MDS module
     * Update aws:Domainjoin plugin logging from Log4Net to NLog
     * Upgrade Go version to 1.24.7
     * Update github.com/go-git/go-git/v5 to 5.15.0
     * Update golang.org/x/crypto to v0.37.0 (bsc#1238702, CVE-2025-22870)
     * Update golang.org/x/net to v0.39.0
     * Update golang.org/x/sys to v0.32.0
     * Add EU sovereign cloud S3 endpoint for DownloadContent plugin
     * Add configurable credential rotation max backoff interval
     * Migrate from twinj/uuid to google/uuid library
     * Allow newer agent versions to be installed when deploying on Greengrass
     * Harden function to remove non-admin run command documents in execution path
     * Fix macOS credential refresher test issue due to missing Debugf from serialport skip file
     * Enhance testability of custom certificate usage in debug SSM Agent builds
     * Decouple serial port from startup and add credential refresher serialport logging
     * Add GlobalEnhancedTelemetryEnabled config to README
     * Add cloudwatch logs endpoint configuration to optional config for agent
     * Update Greengrass component version
     * Add file privilege check before processing document state file
     * Storing AWS document interpolation ENV_VAR types as environment variables
     * Throw explicit error when running local cli as non-priviledged user
     * Harden telemetry dynamic config folder permissions
     * Add configuration option for HandshakeTimeout
     * Improve unit tests
     * Add setup for emitting telemetry logs and metrics
     * Add initial selection of error logs to emit to telemetry
     * Simplify checkstyle and import organization in build scripts
     * Update golang.org/x/net from v0.37.0 to v0.38.0
     * Agent hibernation reason is logged to EC2 system logs
     * Add metrics for the EC2Detector and IMDS EC2 status findings
     * Change Linux DomainJoin plugin parameter KeepHostName to accept        both boolean and string
     * Upgrade GoLang to version 1.23.8
     * Update golang.org/x/crypto from v0.32.0 to v0.36.0 (bsc#1239342, CVE-2025-22869)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20956-1 advisory.

    This update for trivy fixes the following issues

    - CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html:
    multiple issues       when parsing HTML files (bsc#1267047).
    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265648).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266495).
    - CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh     (bsc#1266075).
    - CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266075).
    - CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh     (bsc#1266075).
    - CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in     golang.org/x/crypto/ssh       (bsc#1266075).
    - CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in     golang.org/x/crypto/ssh       (bsc#1266075).
    - CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent       (bsc#1266075).
    - CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266075).
    - CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266075).
    - CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh     (bsc#1266075).
    - CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in     golang.org/x/crypto/ssh/knownhosts       (bsc#1266075).
    - CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in     golang.org/x/crypto/ssh       (bsc#1266075).
    - CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh     (bsc#1266075).
    - CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent     (bsc#1266075).
    - CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to     DoS via infinite       loops, panics or resource consumption (bsc#1267268).

    Changes for trivy:

    - Update to version 0.71.0 (bsc#1267268, CVE-2026-44740):
     * release: v0.71.0 [main] (#10638)
     * ci: use only the first line of commit message in release-please workflow (#10766)
     * feat: add WithDriver and WithProvider options to ospkg detector (#10740)
     * chore(deps): bump github.com/google/go-containerregistry to v0.21.6 (#10741)
     * refactor(secret): normalize configPath once in Init (#10702)
     * feat(secret): add Maven rules to detect passwords and passphrases in settings.xml and settings-     security.xml        files (#10704)
     * chore(deps): bump the common group across 1 directory with 25 updates (#10758)
     * chore: migrate from gomodguard to gomodguard_v2 (#10739)
     * chore(deps): bump the docker group across 1 directory with 2 updates (#10709)
     * chore(deps): bump github.com/aws/aws-sdk-go-v2/service/ec2 from 1.302.0 to 1.303.0 in the aws group     (#10752)
     * ci: scope GitHub App tokens to minimum required permissions (#10755)
     * chore(deps): upgrade go-redis from v8 to v9 (#10736)
     * fix(misconf): fix rendering of nested values in terraform plan lists (#10746)
     * fix(misconf): skip resources with no after changes (#10352)
     * fix(misconf): reject nil plays during playbook parsing (#10273)
     * fix(nodejs): silently skip subdirectory package.json files with invalid names (#10609)
     * fix(misconf): skip null cty values in AsMapValue to prevent panic (#10723)
     * refactor(misconf): replace custom Helm archive parsing with Helm SDK loaders (#10718)
     * chore(deps): bump github.com/containerd/containerd/v2 to v2.3.1 (#10738)
     * chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 (#10686)
     * fix(report): don't produce trailing comma in gitlab.tpl links array (#10728)
     * fix(cloudformation): propagate AWS::EC2::Instance MetadataOptions (#10731)
     * chore(deps): upgrade github.com/cenkalti/backoff dependency to v5 (#10705)
     * chore: bump golangci-lint to v2.12 (#10726)
     * feat(spdx): add SHA-512 hash algorithm support to SPDX serializer (#10719)
     * feat(sbom): support for CycloneDX 1.7 (#10715)
     * chore(deps): bump github.com/aws/aws-sdk-go-v2/service/ec2 from 1.300.0 to 1.302.0 in the aws group     (#10708)
     * chore: migrate from helm.sh/helm/v3 to helm.sh/helm/v4 (#10678)
     * fix(image): correctly reconstruct RUN instructions built without BuildKit (#10714)
     * feat(java): support <mirrors> from settings.xml (#10692)
     * fix(java): surface 429 from a remote Maven repository as a fatal error when scanning pom.xml files     (#10693)
     * chore: bump go to 1.26.3 (#10683)
     * fix(nodejs): handle legacy license formats in npm lockfile parser (#10684)
     * fix(secret): correctly skip secret-scanner config file from scanning (#10666)
     * feat(ubuntu): detect Ubuntu 26.04 LTS (#10592)
     * refactor(nodejs): deduplicate license traversal across package managers (#10681)
     * fix: overwrite OS packages PURLs after overwrite OS (#10298)
     * feat(secret): add Azure secret detection rules (#10562)
     * fix(misconf): prevent path traversal in Terraform filesystem functions (#10664)
     * feat(secret): add a way to customize skipped folders, files and exts (#10550)
     * ci: migrate PAT tokens to GitHub App (#10628)
     * chore(deps): bump the aws group across 1 directory with 6 updates (#10598)
     * chore(deps): bump the docker group across 1 directory with 3 updates (#10596)
     * chore(deps): bump the github-actions group across 2 directories with 9 updates (#10608)
     * chore(deps): bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 (#10641)
     * chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 (#10648)
     * ci: migrate PAT tokens to GITHUB_TOKEN for reusable-release workflow (#10655)
     * feat(seal): add vendor support for language file detection. (#10297)
     * fix(misconf): make identifiers in ignore rules case-insensitive (#10375)
     * fix: pull instead of clone when test repo already exists (#10636)
     * docs: document how to disable check.trivy.dev connections (#10623)
     * docs(misconf): fix typo in misconfiguration config (#10619)
     * ci: remove secrets from run block (#10590)
     * docs: fix typos (#10605)
     * refactor(deps): replace archived go-homedir with os.UserHomeDir (#10484)
     * chore(deps): Bump `go-ini` and fix the import path. (#10489)
     * chore(deps): bump the github-actions group across 2 directories with 9 updates (#10495)
     * chore(deps): bump github.com/aquasecurity/testdocker (#10543)
     * docs: convert README demonstration videos to mp4 (#10419)
     * chore(deps): upgrade vm scan dependency for bug fix (#10575)
     * docs(nodejs): clarify package.json behavior in image scanning (#10572)
     * chore(deps): replace xeipuuv/gojsonschema and invopop/jsonschema with google/jsonschema-go (#10528)
     * chore(deps): bump github.com/go-git/go-git/v5 from 5.17.2 to 5.18.0 (#10554)
     * chore(deps): bump alpine to 3.23.4 (#10552)
     * ci(helm): bump Trivy version to 0.70.0 for Trivy Helm Chart 0.22.0 (#10547)
    - update x/net to v0.55.0 (      bsc#1266495, CVE-2026-39821      bsc#1267047, CVE-2026-25680,      CVE-2026-42502,      CVE-2026-27136,      CVE-2026-25681,      CVE-2026-42506)
    - update x/crypto to 0.52.0 (bsc#1266075, CVE-2026-39827,      CVE-2026-39834,CVE-2026-39828,CVE-2026-39829,CVE-2026-39831,      CVE-2026-42508,CVE-2026-39833,CVE-2026-39830,CVE-2026-39832,      CVE-2026-46597,CVE-2026-46598,CVE-2026-46595,CVE-2026-39835)      bsc#1265648, CVE-2026-33814,

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple     components may improperly handle crafted or malformed input, resulting in panics, infinite loops,     uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation     and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of     unexpected states when processing untrusted repository data and filesystem structures. This issue has been     patched in versions 5.9.0 and 6.0.0-alpha.1. (CVE-2026-44740)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
321922	SUSE SLES12 Security Update : amazon-ssm-agent (SUSE-SU-2026:2468-1)	Nessus	SuSE Local Security Checks	medium
321917	SUSE SLES15 Security Update : amazon-ssm-agent (SUSE-SU-2026:2467-1)	Nessus	SuSE Local Security Checks	medium
321461	openSUSE 16 Security Update : trivy (openSUSE-SU-2026:20956-1)	Nessus	SuSE Local Security Checks	high
318167	Linux Distros Unpatched Vulnerability : CVE-2026-44740	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-44740

medium

Tenable Plugins

medium

medium

high

medium