A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

The version of golang installed on the remote host is prior to 1.26.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3893 advisory.

    Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive     structures. (CVE-2026-33818)

    When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection     to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when     doing this. (CVE-2026-56853)

    Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to     inject arbitrary content, potentially leading to XSS. (CVE-2026-56858)

    Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack     exhaustion. (CVE-2026-56859)

    Previously, resolving relative paths containing parent directory ('..') segments performed string     conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory     allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for     '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
    (CVE-2026-56860)

    Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a     handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages     to force the server to keep performing key derivation operations indefinitely. (CVE-2026-56862)

    A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency     log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content     that cannot be detected by evaluating the transparency log. In order to determine if you have been     affected:   rm -r go.sum go.work.sum vendor/ && go mod tidy (CVE-2026-56864)

    A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested     module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module     cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be     detected by evaluating the transparency log. All tiles are now correctly verified against their parents.
    In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ && go mod tidy     (CVE-2026-56865)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2114 advisory.

    Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive     structures. (CVE-2026-33818)

    When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection     to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when     doing this. (CVE-2026-56853)

    Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to     inject arbitrary content, potentially leading to XSS. (CVE-2026-56858)

    Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack     exhaustion. (CVE-2026-56859)

    Previously, resolving relative paths containing parent directory ('..') segments performed string     conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory     allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for     '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
    (CVE-2026-56860)

    Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a     handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages     to force the server to keep performing key derivation operations indefinitely. (CVE-2026-56862)

    A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency     log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content     that cannot be detected by evaluating the transparency log. In order to determine if you have been     affected:   rm -r go.sum go.work.sum vendor/ && go mod tidy (CVE-2026-56864)

    A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested     module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module     cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be     detected by evaluating the transparency log. All tiles are now correctly verified against their parents.
    In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ && go mod tidy     (CVE-2026-56865)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3815-1 advisory.

    Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged     go1.25.14-1-openssl-fips.

    Security issues fixed:

    - CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can     lead to denial       of service (bsc#1275034).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266609).
    - CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to     support       unencrypted HTTP/2 allows for denial of service (bsc#1275028).
    - CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level `{` can lead to     XSS       (bsc#1275033).
    - CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding     operations can       lead to denial of service (bsc#1275026).
    - CVE-2026-56860: net/url: quadratic complexity in `resolvePath` when processing backtrack path elements     can lead to       denial of service (bsc#1275029).
    - CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which     can lead to       a denial of service (bsc#1275032).
    - CVE-2026-56864: x/mod/sumdb: a malicious `GOSUMDB` is capable of serving arbitrary module content not     contained       within the transparency log (bsc#1275025).
    - CVE-2026-56865: x/mod/sumdb/tlog: a malicious `GOPROXY` is capable of forging sumdb tiles, which allows     for bypass of       the `GOSUMDB` check and persistence of attacker-controlled module contents to a local Go module cache     (bsc#1275024).

    Other updates and bugfixes:

    - Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged     go1.25.14-1-openssl-fips:
      (jsc#SLE-18320):
      * Rebase to 1.25.14
    - go1.25.14 (released 2026-08-19, boo#1244485):
      * go#80926 net/http: `ReadHeaderTimeout` remains active after unencrypted HTTP/2 handoff
    - go1.25.13 (released 2026-08-13):
      * includes security fixes to the `go` command, and the `crypto/tls`, `encoding/asn1`, `encoding/xml`,     `html/template`,         `net/http`, and `net/url` packages, as well as bug fixes to the compiler, the runtime, and the     `crypto/tls` and `os`         packages.
      * go#79876 cmd/compile: `prove` miscompilation in `slicemask` folding leaves garbage in the upper bits
      * go#80098 cmd/compile: internal compiler error invalid heap allocated var without `Heapaddr`
      * go#80364 os: `Root`'s `MkdirAll` can't create paths ending in forward slashes
      * go#80366 os: `TestRootMultiReadFile` fails on `netbsd/arm64` after CL 797880
      * go#80368 os: `TestRootConsistencyRemoveAll` fails on Plan 9 after CL 797880
      * go#80393 runtime: `arm64` found pointer to free object with safe code
      * go#80440 runtime: uninitialized register due to wrong ABI in `mach_vm_region_trampoline` leads to     `libc` following         garbage stack data as a pointer
      * go#80477 cmd/compile: `riscv64` miscompiles struct copy, corrupting a `[]byte` slice field
      * go#80500 runtime: js/wasm: 'found bad pointer in Go heap' -- link-layout-constant value recorded as a     pointer in the         write-barrier buffer
      * go#80578 cmd/compile: `regalloc` uses unreliable type data (like `v.Type.IsSigned()`) to choose the     restore of         spills
      * go#80605 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
      * go#80614 cmd/compile: `mips64le` miscompiles `OffPtr` by a const which doesn't fit 32bits resulting in     panic
      * go#80616 cmd/compile: `mips`/`mips64`, multiply/divide results spilled from `HI`/`LO` corrupted w/ big     stack frames
      * go#80618 cmd/compile: `prove` bug causes invalid indirect call
      * go#80737 runtime: `fpTracebackPartialExpand` `SIGSEGV` under high panic load
    - Update to version 1.25.12 cut from the go1.25-fips-release branch at the revision tagged     go1.25.12-2-openssl-fips:
      * Limit openssl `RandReader` concurrency (#374)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3816-1 advisory.

    Update to version 1.26.7 cut from the go1.25-fips-release at the revision tagged go1.26.7-1-openssl-fips.

    Security issues fixed:

    - CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can     lead to denial       of service (bsc#1275034).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266609).
    - CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to     support       unencrypted HTTP/2 allows for denial of service (bsc#1275028).
    - CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level `{` can lead to     XSS       (bsc#1275033).
    - CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding     operations can       lead to denial of service (bsc#1275026).
    - CVE-2026-56860: net/url: quadratic complexity in `resolvePath` when processing backtrack path elements     can lead to       denial of service (bsc#1275029).
    - CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which     can lead to       a denial of service (bsc#1275032).
    - CVE-2026-56864: x/mod/sumdb: a malicious `GOSUMDB` is capable of serving arbitrary module content not     contained       within the transparency log (bsc#1275025).
    - CVE-2026-56865: x/mod/sumdb/tlog: a malicious `GOPROXY` is capable of forging sumdb tiles, which allows     for bypass of       the `GOSUMDB` check and persistence of attacker-controlled module contents to a local Go module cache     (bsc#1275024).

    Other updates and bugfixes:

    - Update to version 1.26.7 cut from the go1.25-fips-release branch at the revision tagged     go1.26.7-1-openssl-fips:
      (jsc#SLE-18320).
      * Rebase to 1.26.7
      * Support `strictfipsruntime` with `no_openssl`
      * Fix multiple `no_openssl` build tag issues
    - go1.26.7 (released 2026-08-19, boo#1255111):
      * go#80927 net/http: `ReadHeaderTimeout` remains active after unencrypted `HTTP/2` handoff
    - go1.26.6 (released 2026-08-13):
      * includes security fixes to the `go` command, and the `crypto/tls`, `encoding/asn1`, `encoding/xml`,         `html/template`, `net`, `net/http`, and `net/url` packages, as well as bug fixes to the compiler, the     linker, the         runtime, and the `crypto/tls` and `os` packages.
      * go#79876 cmd/compile: `prove` misscompilation in `slicemask` folding leaves garbage in the upper bits
      * go#80099 cmd/compile: internal compiler error invalid heap allocated var without `Heapaddr`
      * go#80131 cmd/link: `peCreateExportFile` generates invalid `.def` file when output name has trailing     dot (`c-shared`         on Windows)
      * go#80365 os: `Root`'s `MkdirAll` can't create paths ending in forward slashes
      * go#80367 os: `TestRootMultiReadFile` fails on `netbsd/arm64` after CL 797880
      * go#80369 os: `TestRootConsistencyRemoveAll` fails on Plan 9 after CL 797880
      * go#80394 runtime: `arm64` found pointer to free object with safe code
      * go#80441 runtime: uninitialized register due to wrong ABI in `mach_vm_region_trampoline` leads to     `libc` following         garbage stack data as a pointer
      * go#80478 cmd/compile: `riscv64` miscompiles struct copy, corrupting a `[]byte` slice field
      * go#80499 runtime: js/wasm: 'found bad pointer in Go heap' -- link-layout-constant value recorded as a     pointer in         the write-barrier buffer
      * go#80579 cmd/compile: `regalloc` uses unreliable type data (like `v.Type.IsSigned()`) to choose the     restore of         spills
      * go#80606 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
      * go#80609 net, x/net/dns/dnsmessage: panic when parsing invalid `SVCB` record
      * go#80615 cmd/compile: `mips64le` misscompile `OffPtr` by a const which doesn't fit 32bits resulting in     panic
      * go#80617 cmd/compile: `mips`/`mips64`, multiply/divide results spilled from `HI`/`LO` corrupted w/ big     stack frames
      * go#80619 cmd/compile: `prove` bug causes invalid indirect call
      * go#80715 runtime: `fpTracebackPartialExpand` `SIGSEGV` under high panic load
    - Update to version 1.26.5 cut from the go1.25-fips-release branch at the revision tagged     go1.26.5-2-openssl-fips:
      * Limit `openssl` `RandReader` concurrency

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3799-1 advisory.

    Update to version 1.26.7 cut from the go1.25-fips-release at the revision tagged go1.26.7-1-openssl-fips.

    Security issues fixed:

    - CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can     lead to denial       of service (bsc#1275034).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266609).
    - CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to     support       unencrypted HTTP/2 allows for denial of service (bsc#1275028).
    - CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level `{` can lead to     XSS       (bsc#1275033).
    - CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding     operations can       lead to denial of service (bsc#1275026).
    - CVE-2026-56860: net/url: quadratic complexity in `resolvePath` when processing backtrack path elements     can lead to       denial of service (bsc#1275029).
    - CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which     can lead to       a denial of service (bsc#1275032).
    - CVE-2026-56864: x/mod/sumdb: a malicious `GOSUMDB` is capable of serving arbitrary module content not     contained       within the transparency log (bsc#1275025).
    - CVE-2026-56865: x/mod/sumdb/tlog: a malicious `GOPROXY` is capable of forging sumdb tiles, which allows     for bypass of       the `GOSUMDB` check and persistence of attacker-controlled module contents to a local Go module cache     (bsc#1275024).

    Other updates and bugfixes:

    - Update to version 1.26.7 cut from the go1.25-fips-release branch at the revision tagged     go1.26.7-1-openssl-fips:
      (jsc#SLE-18320).
      * Rebase to 1.26.7
      * Support `strictfipsruntime` with `no_openssl`
      * Fix multiple `no_openssl` build tag issues
    - go1.26.7 (released 2026-08-19, boo#1255111):
      * go#80927 net/http: `ReadHeaderTimeout` remains active after unencrypted `HTTP/2` handoff
    - go1.26.6 (released 2026-08-13):
      * includes security fixes to the `go` command, and the `crypto/tls`, `encoding/asn1`, `encoding/xml`,         `html/template`, `net`, `net/http`, and `net/url` packages, as well as bug fixes to the compiler, the     linker, the         runtime, and the `crypto/tls` and `os` packages.
      * go#79876 cmd/compile: `prove` misscompilation in `slicemask` folding leaves garbage in the upper bits
      * go#80099 cmd/compile: internal compiler error invalid heap allocated var without `Heapaddr`
      * go#80131 cmd/link: `peCreateExportFile` generates invalid `.def` file when output name has trailing     dot (`c-shared`         on Windows)
      * go#80365 os: `Root`'s `MkdirAll` can't create paths ending in forward slashes
      * go#80367 os: `TestRootMultiReadFile` fails on `netbsd/arm64` after CL 797880
      * go#80369 os: `TestRootConsistencyRemoveAll` fails on Plan 9 after CL 797880
      * go#80394 runtime: `arm64` found pointer to free object with safe code
      * go#80441 runtime: uninitialized register due to wrong ABI in `mach_vm_region_trampoline` leads to     `libc` following         garbage stack data as a pointer
      * go#80478 cmd/compile: `riscv64` miscompiles struct copy, corrupting a `[]byte` slice field
      * go#80499 runtime: js/wasm: 'found bad pointer in Go heap' -- link-layout-constant value recorded as a     pointer in         the write-barrier buffer
      * go#80579 cmd/compile: `regalloc` uses unreliable type data (like `v.Type.IsSigned()`) to choose the     restore of         spills
      * go#80606 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
      * go#80609 net, x/net/dns/dnsmessage: panic when parsing invalid `SVCB` record
      * go#80615 cmd/compile: `mips64le` misscompile `OffPtr` by a const which doesn't fit 32bits resulting in     panic
      * go#80617 cmd/compile: `mips`/`mips64`, multiply/divide results spilled from `HI`/`LO` corrupted w/ big     stack frames
      * go#80619 cmd/compile: `prove` bug causes invalid indirect call
      * go#80715 runtime: `fpTracebackPartialExpand` `SIGSEGV` under high panic load
    - Update to version 1.26.5 cut from the go1.25-fips-release branch at the revision tagged     go1.26.5-2-openssl-fips:
      * Limit `openssl` `RandReader` concurrency

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3800-1 advisory.

    Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged     go1.25.14-1-openssl-fips.

    Security issues fixed:

    - CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can     lead to denial       of service (bsc#1275034).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266609).
    - CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to     support       unencrypted HTTP/2 allows for denial of service (bsc#1275028).
    - CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level `{` can lead to     XSS       (bsc#1275033).
    - CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding     operations can       lead to denial of service (bsc#1275026).
    - CVE-2026-56860: net/url: quadratic complexity in `resolvePath` when processing backtrack path elements     can lead to       denial of service (bsc#1275029).
    - CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which     can lead to       a denial of service (bsc#1275032).
    - CVE-2026-56864: x/mod/sumdb: a malicious `GOSUMDB` is capable of serving arbitrary module content not     contained       within the transparency log (bsc#1275025).
    - CVE-2026-56865: x/mod/sumdb/tlog: a malicious `GOPROXY` is capable of forging sumdb tiles, which allows     for bypass of       the `GOSUMDB` check and persistence of attacker-controlled module contents to a local Go module cache     (bsc#1275024).

    Other updates and bugfixes:

    - Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged     go1.25.14-1-openssl-fips:
      (jsc#SLE-18320):
      * Rebase to 1.25.14
    - go1.25.14 (released 2026-08-19, boo#1244485):
      * go#80926 net/http: `ReadHeaderTimeout` remains active after unencrypted HTTP/2 handoff
    - go1.25.13 (released 2026-08-13):
      * includes security fixes to the `go` command, and the `crypto/tls`, `encoding/asn1`, `encoding/xml`,     `html/template`,         `net/http`, and `net/url` packages, as well as bug fixes to the compiler, the runtime, and the     `crypto/tls` and `os`         packages.
      * go#79876 cmd/compile: `prove` miscompilation in `slicemask` folding leaves garbage in the upper bits
      * go#80098 cmd/compile: internal compiler error invalid heap allocated var without `Heapaddr`
      * go#80364 os: `Root`'s `MkdirAll` can't create paths ending in forward slashes
      * go#80366 os: `TestRootMultiReadFile` fails on `netbsd/arm64` after CL 797880
      * go#80368 os: `TestRootConsistencyRemoveAll` fails on Plan 9 after CL 797880
      * go#80393 runtime: `arm64` found pointer to free object with safe code
      * go#80440 runtime: uninitialized register due to wrong ABI in `mach_vm_region_trampoline` leads to     `libc` following         garbage stack data as a pointer
      * go#80477 cmd/compile: `riscv64` miscompiles struct copy, corrupting a `[]byte` slice field
      * go#80500 runtime: js/wasm: 'found bad pointer in Go heap' -- link-layout-constant value recorded as a     pointer in the         write-barrier buffer
      * go#80578 cmd/compile: `regalloc` uses unreliable type data (like `v.Type.IsSigned()`) to choose the     restore of         spills
      * go#80605 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
      * go#80614 cmd/compile: `mips64le` miscompiles `OffPtr` by a const which doesn't fit 32bits resulting in     panic
      * go#80616 cmd/compile: `mips`/`mips64`, multiply/divide results spilled from `HI`/`LO` corrupted w/ big     stack frames
      * go#80618 cmd/compile: `prove` bug causes invalid indirect call
      * go#80737 runtime: `fpTracebackPartialExpand` `SIGSEGV` under high panic load
    - Update to version 1.25.12 cut from the go1.25-fips-release branch at the revision tagged     go1.25.12-2-openssl-fips:
      * Limit openssl `RandReader` concurrency (#374)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21593-1 advisory.

    Update to go1.26.6 (released 2026-08-13, bsc#1255111).

    Security issues fixed:

    - CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead to stack exhaustion when parsing     deeply-nested,       recursive structures (bsc#1275034).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266609).
    - CVE-2026-56853: net/http: missing timeout when doing unencrypted HTTP/2 check can lead to a denial of     service       (bsc#1275028).
    - CVE-2026-56858: html/template: improper Javascript regexp context tracking allows for XSS attacks     (bsc#1275033).
    - CVE-2026-56859: encoding/xml: missing recursion depth guard during decode operation can lead to stack     exhaustion       and a denial of service (bsc#1275026).
    - CVE-2026-56860: net/url: quadratic time complexity in `resolvePath` when processing certain input can     lead to high       memory allocation overhead and a denial of service (bsc#1275029).
    - CVE-2026-56862: crypto/tls: no limit set for handshake messages sent post-handshake allows for denial of     service       (bsc#1275032).
    - CVE-2026-56864: x/mod/sumdb: unauthenticated hashes accepted in `Lookup` allows for a coordinating     GOPROXY and       GOSUMDB to serve a client malicious module content (bsc#1275025).
    - CVE-2026-56865: x/mod/sumdb/tlog: improper transparency log tile verification allows for bypass on     crafted input       and can lead to malicious module content to be accepted (bsc#1275024).

    Changes for go1.26.6:

    - go#79876 cmd/compile: prove misscompilation in slicemask folding leaves garbage in the upper bits
    - go#80099 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr
    - go#80131 cmd/link: peCreateExportFile generates invalid .def file when output name has trailing dot     (c-shared on       Windows)
    - go#80365 os: Root's MkdirAll can't create paths ending in forward slashes
    - go#80367 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880
    - go#80369 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880
    - go#80394 runtime: arm64 found pointer to free object with safe code
    - go#80441 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc     following       garbage stack data as a pointer
    - go#80478 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field
    - go#80499 runtime: js/wasm: found bad pointer in Go heap -- link-layout-constant value recorded as a     pointer in       the write-barrier buffer
    - go#80579 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore     of spills
    - go#80606 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
    - go#80609 net, x/net/dns/dnsmessage: panic when parsing invalid SVCB record
    - go#80615 cmd/compile: mips64le misscompile OffPtr by a const which doesn't fit 32bits resulting in panic
    - go#80617 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack     frames
    - go#80619 cmd/compile: prove bug causes invalid indirect call
    - go#80715 runtime: fpTracebackPartialExpand SIGSEGV under high panic load

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21592-1 advisory.

    Update to go1.25.13 (released 2026-08-13, bsc#1244485).


    Security issues fixed:

    - CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead to stack exhaustion when parsing     deeply-nested,       recursive structures (bsc#1275034).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266609).
    - CVE-2026-56853: net/http: missing timeout when doing unencrypted HTTP/2 check can lead to a denial of     service       (bsc#1275028).
    - CVE-2026-56858: html/template: improper Javascript regexp context tracking allows for XSS attacks     (bsc#1275033).
    - CVE-2026-56859: encoding/xml: missing recursion depth guard during decode operation can lead to stack     exhaustion       and a denial of service (bsc#1275026).
    - CVE-2026-56860: net/url: quadratic time complexity in `resolvePath` when processing certain input can     lead to high       memory allocation overhead and a denial of service (bsc#1275029).
    - CVE-2026-56862: crypto/tls: no limit set for handshake messages sent post-handshake allows for denial of     service       (bsc#1275032).
    - CVE-2026-56864: x/mod/sumdb: unauthenticated hashes accepted in `Lookup` allows for a coordinating     GOPROXY and       GOSUMDB to serve a client malicious module content (bsc#1275025).
    - CVE-2026-56865: x/mod/sumdb/tlog: improper transparency log tile verification allows for bypass on     crafted input       and can lead to malicious module content to be accepted (bsc#1275024).

    Changes for go1.25.13:

    - go#79875 cmd/compile: prove misscompilation in slicemask folding leaves garbage in upper bits
    - go#80098 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr
    - go#80364 os: Root's MkdirAll can't create paths ending in forward slashes
    - go#80366 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880
    - go#80368 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880
    - go#80393 runtime: arm64 found pointer to free object with safe code
    - go#80440 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc     following       garbage stack data as a pointer
    - go#80477 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field
    - go#80500 runtime: js/wasm: found bad pointer in Go heap -- link-layout-constant value recorded as a     pointer in the       write-barrier buffer
    - go#80578 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore     of spills
    - go#80605 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
    - go#80614 cmd/compile: mips64le misscompile OffPtr by a const which doesn't fit 32bits resulting in panic
    - go#80616 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack     frames
    - go#80618 cmd/compile: prove bug causes invalid indirect call
    - go#80737 runtime: fpTracebackPartialExpand SIGSEGV under high panic load

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3641-1 advisory.

    Security issues fixed:

    - CVE-2026-33818: encoding/asn1: enforce maximum recursion depth (bsc#1275034).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266609).
    - CVE-2026-56853: net/http: apply ReadHeaderTimeout when doing unencrypted HTTP/2 check (bsc#1275028).
    - CVE-2026-56858: html/template: fix Javascript regexp context tracking (bsc#1275033).
    - CVE-2026-56859: encoding/xml: add recursion depth guard during decode (bsc#1275026).
    - CVE-2026-56860: net/url: avoid quadratic complexity in resolvePath (bsc#1275029).
    - CVE-2026-56862: crypto/tls: limit handshake messages we are willing to accept post-handshake     (bsc#1275032).
    - CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
    - CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).

    Non security issue fixed:

    - go1.26 release tracking (bsc#1255111).

    Changes for go1.26:

    - update to go1.26.6
     * go#79876 cmd/compile: prove misscompilation in slicemask folding leaves garbage in the upper bits
     * go#80099 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr
     * go#80131 cmd/link: peCreateExportFile generates invalid .def file when output name has trailing dot     (c-shared on Windows)
     * go#80365 os: Root's MkdirAll can't create paths ending in forward slashes
     * go#80367 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880
     * go#80369 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880
     * go#80394 runtime: arm64 found pointer to free object with safe code
     * go#80441 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc     following garbage stack data as a pointer
     * go#80478 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field
     * go#80499 runtime: js/wasm: 'found bad pointer in Go heap' -- link-layout-constant value recorded as a     pointer in the write-barrier buffer
     * go#80579 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore     of spills
     * go#80606 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
     * go#80609 net, x/net/dns/dnsmessage: panic when parsing invalid SVCB record
     * go#80615 cmd/compile: mips64le misscompile OffPtr by a const which doesn't fit 32bits resulting in     panic
     * go#80617 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack     frames
     * go#80619 cmd/compile: prove bug causes invalid indirect call
     * go#80715 runtime: fpTracebackPartialExpand SIGSEGV under high panic load

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3640-1 advisory.

    Security issues fixed:

    - CVE-2026-33818: encoding/asn1: enforce maximum recursion depth (bsc#1275034).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266609).
    - CVE-2026-56853: net/http: apply ReadHeaderTimeout when doing unencrypted HTTP/2 check (bsc#1275028).
    - CVE-2026-56858: html/template: fix Javascript regexp context tracking (bsc#1275033).
    - CVE-2026-56859: encoding/xml: add recursion depth guard during decode (bsc#1275026).
    - CVE-2026-56860: net/url: avoid quadratic complexity in resolvePath (bsc#1275029).
    - CVE-2026-56862: crypto/tls: limit handshake messages we are willing to accept post-handshake     (bsc#1275032).
    - CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
    - CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).

    Non security issue fixed:

    - go1.25 release tracking (bsc#1244485).

    Changes for go1.25:

    - update to go1.25.13
     * go#79875 cmd/compile: prove misscompilation in slicemask folding leaves garbage in upper bits
     * go#80098 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr
     * go#80364 os: Root's MkdirAll can't create paths ending in forward slashes
     * go#80366 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880
     * go#80368 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880
     * go#80393 runtime: arm64 found pointer to free object with safe code
     * go#80440 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc     following garbage stack data as a pointer
     * go#80477 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field
     * go#80500 runtime: js/wasm: 'found bad pointer in Go heap' -- link-layout-constant value recorded as a     pointer in the write-barrier buffer
     * go#80578 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore     of spills
     * go#80605 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
     * go#80614 cmd/compile: mips64le misscompile OffPtr by a const which doesn't fit 32bits resulting in     panic
     * go#80616 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack     frames
     * go#80618 cmd/compile: prove bug causes invalid indirect call
     * go#80737 runtime: fpTracebackPartialExpand SIGSEGV under high panic load

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested
    module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module
    cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be
    detected by evaluating the transparency log. All tiles are now correctly verified against their parents.
    In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
    (CVE-2026-56865)

The version of Golang running on the remote host is 1.25.x prior to 1.25.13, or 1.26.x prior to 1.26.6. It is, therefore, affected by multiple vulnerabilities in the standard library and the toolchain, as referenced in the golang-announce advisory.

  - The ToASCII and ToUnicode functions incorrectly accepted Punycode-encoded labels that decode to an     ASCII-only label. This can lead to privilege escalation in programs using the idna package.
    (CVE-2026-39821)

  - When a server is configured to support unencrypted HTTP/2, it reads bytes from each new connection     to check for the HTTP/2 client preface. Previously this was done with no timeout. ReadHeaderTimeout     is now applied for this check. (CVE-2026-56853)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested     module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module     cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be     detected by evaluating the transparency log. All tiles are now correctly verified against their parents.
    In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy     (CVE-2026-56865)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
341867	Amazon Linux 2 : golang, --advisory ALAS2-2026-3893 (ALAS-2026-3893)	Nessus	Amazon Linux Local Security Checks	Local	high
341840	Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2026-2114)	Nessus	Amazon Linux Local Security Checks	Local	high
341654	SUSE SLED15 / SLES15 Security Update : go1.25-openssl (SUSE-SU-2026:3815-1)	Nessus	SuSE Local Security Checks	Local	high
341653	SUSE SLED15 / SLES15 Security Update : go1.27 (SUSE-SU-2026:3830-1)	Nessus	SuSE Local Security Checks	Local	high
341640	SUSE SLED15 / SLES15 Security Update : go1.26-openssl (SUSE-SU-2026:3816-1)	Nessus	SuSE Local Security Checks	Local	high
341021	SUSE SLES15 Security Update : go1.26-openssl (SUSE-SU-2026:3799-1)	Nessus	SuSE Local Security Checks	Local	high
341000	SUSE SLES15 Security Update : go1.25-openssl (SUSE-SU-2026:3800-1)	Nessus	SuSE Local Security Checks	Local	high
338686	openSUSE 16 Security Update : go1.26 (openSUSE-SU-2026:21593-1)	Nessus	SuSE Local Security Checks	Local	high
338685	openSUSE 16 Security Update : go1.25 (openSUSE-SU-2026:21592-1)	Nessus	SuSE Local Security Checks	Local	high
337976	SUSE SLED15 / SLES15 Security Update : go1.26 (SUSE-SU-2026:3641-1)	Nessus	SuSE Local Security Checks	Local	high
337975	SUSE SLED15 / SLES15 Security Update : go1.25 (SUSE-SU-2026:3640-1)	Nessus	SuSE Local Security Checks	Local	high
445968	Golang: stdlib: security update to 1.25.13stdlib: security update to 1.26.6stdlib: security update to 1.27.0-rc.3	Tenable Cloud Security	Golang	Local	high
445968	Golang: stdlib: security update to 1.25.13stdlib: security update to 1.26.6stdlib: security update to 1.27.0-rc.3	Tenable Self-Hosted Container Security	Golang	Local	high
335411	Golang 1.25.x < 1.25.13 / 1.26.x < 1.26.6 Multiple Vulnerabilities	Nessus	Misc.	Local	high
335371	Linux Distros Unpatched Vulnerability : CVE-2026-56865	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-56865

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high