compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.

suse_linux SUSE-SU-2026:24261-1: SUSE SLES16 : Security update for aliyun-cli (Important) (SUSE-SU-2026:24261-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22134-1 advisory.

    Changes in gh:

    - Update to version 2.102.0, fixing four security issues       (GHSA-39wj-f2f4-978v, GHSA-4mq3-hpgx-9cx8, GHSA-qcwj-mr2r-2cx7,       GHSA-wjmr-j3rp-mh2g):

      * gh release/run/attestation download and repo read-file --output         could write to an unintended file through symbolic links
      * gh attestation verify compared --source-ref case-insensitively
      * gh attestation verify matched --signer-workflow only by prefix
      * gh skill search could inject options into gh skill install
      * Copy auth codes to the clipboard by default (gh config set         clipboard disabled to opt out)
      * Remove the gh repo garden command and the multi-account migration
      * Use API SSH URLs for repository clones
      * Validate repository names during interactive creation
      * Fix remote branch deletion on owner case mismatch
      * Propagate the gh path to extensions
      * Allow ghu_ tokens to attach files
      * Allow gh repo set-default --unset without an argument
      * Bump go-gh to 2.16.1, golang.org/x/crypto to 0.57.0,         github.com/klauspost/compress to 1.20.1 and Go to 1.27.1
    - Update golang.org/x/net to 0.60.0 to fix       excessive CPU consumption on repeated HTTP/2 initial window       changes (CVE-2026-78669, bsc#1285291).
    - Require golang(API) >= 1.27 as upstream moved to Go 1.27.
    - Not affected, vendored dependencies are above the fixed version:
      * CVE-2026-84445 (bsc#1278962): grpc is 1.83.2, fixed in 1.83.2
      * CVE-2026-84304 (bsc#1279208), CVE-2026-84303 (bsc#1279310):
        grpc is 1.83.2, fixed in 1.83.1
      * CVE-2026-41178 (bsc#1276707): otel/baggage is 1.44.0, fixed in         1.44.0
      * CVE-2026-63209 (bsc#1283727): klauspost/compress is 1.20.1,         contains the fix of 1.18.7
      * CVE-2026-72924 (bsc#1276755): gh is above 2.98.0, the fixed         version
      * CVE-2026-59831 (bsc#1271215): gh is above 2.95.0, the last         affected version

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22140-1 advisory.

    This update for aliyun-cli fixes the following issue:

    - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an     attacker to bypass       repeat index validation and cause a process crash (bsc#1283596).

    Changes for aliyun-cli:

    - Update to version 3.5.1
     * Add opt-in built-in OSS JSON/JSONL listings with bounded pages and resumable      cursors, structured errors with recovery guidance, and non-interactive      confirmation handling (#1452).
     * Add offline validation and read-only plans for single-file uploads and      single-object deletion; record exact failed targets in exclusive JSONL      manifests for cp/sync and expose sync deletion-phase state (#1452).
     * Fix the OSS bridge to preserve option order and `--`, propagate parser and      service errors, pass profile region/timeouts/retry budgets, and refresh host      credentials at request time without injecting them into argv (#1454).
     * Stop replaying writes after ambiguous transport or server failures; classify      retries with jittered backoff, join workers before closing reports, and fix      progress data races and failure-report filename collisions (#1452).
     * Enforce the host safety policy for legacy OSS operations and reject      unsupported preview combinations (#1452, #1454).
     * Harden policy parsing and environment overrides to fail closed on invalid      configuration; explicit deny rules cannot be bypassed by `--force`, `--yes`,      or AI mode.
     * Enforce the safety policy before built-in extension dispatch      (cliext/safety.go).
     * Restrict legacy FNF request-signing compatibility to a product allowlist (#1447).
     * API alias canonicalization was reverted and held: aliases and PascalCase/      kebab-case spellings remain separate policy matches, matching command      spelling exactly as typed.
     * Version AI-mode OpenAPI and OSS error envelopes with `schemaVersion: v1`,      and return structured startup configuration errors (#1453).
     * Add ALIBABA_CLOUD_CLI_AGENT_INTEGRATION controls for automatic AI mode;
     expand agent detection, User-Agent attribution, and Qoder China CLI      detection (#1445, #1455).
     * Support case-insensitive product routing for in-process OpenAPI commands (#1445).
     * Expose regional and VPC product endpoints through queryable product Help (#1448).
     * Support camel RPC flat arrays (#1456) and prefer product prefix/substring      suggestions over edit distance in Did you mean output.
     * Upgrade JMESPath to support `json.Number`, preserving large-number      comparison and sorting precision and fixing empty-array average semantics.
     * Dispatch newly installed metadata plugins in-process (#1439).
     * Harden plugin archive extraction, package replacement/rollback, and download      URL diagnostics (#1442).
     * Redact JSON and form bodies based on content while preserving the encoding      of original form stars; keep raw and unparseable dry-run bodies intact      (#1440, #1449).
     * Prefer native macOS architecture packages in install.sh (#1433).
     * Keep prerelease tags off the stable latest pointer and fail closed when      release asset downloads are incomplete (#1437).
     * Include cliext in required checks, fix cross-platform test failures (#1446),      restore single-file entrypoint builds, and stabilize language tests.
     * Update the aliyun-openapi-meta submodule and release jobs.
     * Add the OSS automation guide (en / zh-CN), document startup errors, exit      statuses and command-spelling safety matching (#1450), and add the v3.5.1      CHANGELOG entry.
    - from version 3.5.0
     * docs: add StsToken credential mode to README by @yndu13 in (#1403)
     * Built-in plugin and AI MODE enhancement by @yndu13 in (#1411)
     * Update Aliyun OpenAPI meta data
    - Update to version 3.4.11
     * feat(openapi): extend --estimate-cost coverage (pricing context,      SLS/openapi path, oss bridge, by-triple) and scripting contract      by @api-tool-agent in (#1399)
    - from version 3.4.10      (no changes)
    - from version 3.4.9
     * fix(maxc): fall back when symlink creation fails on Windows      by @yndu13 in (#1390)
     * fix: quote-aware External process_command parsing by @yndu13 in (#1391)
     * fix: POSIX line-continuation in External process_command splitting      by @yndu13 in (#1392)
     * Improve invalid flag error with did-you-mean hints by @yndu13 in (#1394)
     * fix: atomically write config.json via temp+rename by @yndu13 in (#1387)
     * fix: detect throttling by x-acs-retry-after header by @yndu13 in (#1395)
     * feat: add aliyun ecctl for Elastic Compute Control CLI by @yndu13 in (#1397)
     * fix: allow --profile with aliyun oss subcommands by @yndu13 in (#1398)
    - Update to version 3.4.8
     * fix(test): mock plugin index for offline-stable Windows CI by @yndu13 in (#1379)
     * fix: correct waiter timeout/interval range validation by @yndu13 in (#1382)
     * feat(openapi): add --cli-dry-run flag for built-in PascalCase commands      by @CodeSpaceiiii in (#1383)
     * fix: persist configure read-timeout as read_timeout by @yndu13 in (#1384)
     * fix: ignore empty --mode so env credentials still apply by @yndu13 in (#1386)
     * feat: add mseutil command to aliyun CLI by @yndu13 in (#1381)
     * fix(oss): honor profile endpoint and endpoint-type vpc by @yndu13 in (#1385)
     * fix: correct import order in openapi/library_test.go by @CodeSpaceiiii      with @Copilot in (#1388)
     * Fix invisible API parameter names in help output (bold-black on dark terminals)      by @mvanhorn in (#1362)
     * feat: integrate flow-cli into Aliyun CLI by @yndu13 in (#1380)
     * fix(esacli): harden exec override and shorthand flags by @yndu13 in (#1389)
    - from version 3.4.7
     * {plugin} Add alias support for plugin by @AllyW in (#1376)
     * feat(mock): add response_body_size for controllable mock stdout size      by @yndu13 in (#1378)
     * fix(plugin): prevent bulk update plugin pointer aliasing by @yndu13 in (#1377)
    - from version 3.4.6
     * feat(openapi): add --estimate-cost-context to pass PricingContext to quotes      by @LCLSpring in (#1373)
     * feat(mock): add delay_ms field to simulate command execution latency      by @yndu13 in (#1375)
    - Update to version 3.4.5
     * [Feature] Support ESA CLI Sub Command by @msyysm1211 in (#1345)
     * feat(config): support STS endpoint override for OIDC and role      auth by @yndu13 in (#1372)
    - from version 3.4.4
     * (no changes)
    - from version 3.4.3
     * fix: correct valid typo in invalid command error by @yndu13 in (#1365)
     * {Misc} Add ALIBABA_CLOUD_DISABLE_EXTERNAL_PROCESS to disable external      process by @AllyW in (#1366)
    - from version 3.4.2
     * feat(openapi): add --estimate-cost and list-supported-pricing-apis      by @LCLSpring in (#1364)
    - Update to version 3.4.1
     * [Feature]Add Aliyun Lindorm CLI Subcommand by @MistySoul in (#1361)
     * {cliext} Add aliyun spark-submit by @AllyW in (#1358)
    - from version 3.4.0
     * feat(acrutil): extract shared binary manager and add diagnosis      subcommand by @copyrightpoiiiii in (#1349)
     * [feature] add rostran sub command by @xiao201208 in (#1350)
     * {OpenAPI} Add --cli-dry-run-json by @AllyW in (#1306)
     * {Misc} Fix plugin three layer cmd help by @AllyW in (#1343)
     * Feature/support anonymous by @yuexiu94 in (#1354)
     * feat: support retry-after policy for throttling error by @yndu13      in (#1355)
    - Update to version 3.3.23
     * {Plugin} Allow plugins to opt out of host profile enforcement      by @AllyW in (#1348)
    - Update to version 3.3.22
     * {Logging} Skip list for self-built-gateway products by @AllyW in (#1346)
    - from version 3.3.21
     * {Configure} Match policy rules against the command users actually type      for ROA by @AllyW in (#1344)
    - from version 3.3.20
     * {OpenAPI} Add call context logging by @AllyW in (#1342)
    - from version 3.3.19
     * [Feature] Support MaxC CLI Sub Command by @dingxin-tech in (#1332)
     * feat(appmanager): Generalized PrepareEnv credential pass-through      supports multiple authentication modes by @mengjunwei-mjw in (#1341)
    - from version 3.3.18
     * Improve CMS2 command descriptions and clarify exception      return codes by @tingbin-ctb in (#1337)
     * feat(iact3): add iact3 subcommand with manual upgrade      by @xiao201208 in (#1336)
     * Add kmscli command by @oobujieshi in (#1340)
    - from version 3.3.17
     * {Plugin} Support lang and profile from flag for plugin      execution by @AllyW in (#1330)
     * Computenest pypi venv by @mengjunwei-mjw in (#1331)
     * feat: add codeup-cli subcommand for migrating third-party      code repos by @imu2008 in (#1335)
    - from version 3.3.16
     * Optimize error messages by @CodeSpaceiiii in (#1327)
     * {Openapi} Return InvalidApiError for unknown API on      restful products by @AllyW in (#1326)
     * feat(acrutil): Add Alibaba Cloud Container Registry(ACR)      Skill management CLI subcommand by @copyrightpoiiiii in (#1329)
     * {Configure} Support BearerToken profile mode by @AllyW in (#1333)
    - from version 3.3.15
     * feat add saectl by @Beimingx in (#1319)
     * Cloud Monitor version 2.0: Independent binary access,      Aliyun CMS2 subcommands by @thinkbetter18 in (#1322)
     * feat(otel): integrate OpenTelemetry support with environment      variable by @CodeSpaceiiii in (#1324)
     * aliyuncms has been renamed to aliyuncms2. COMPAT_MODE, USER_AGENT,      AI_USER_AGENT, and OTEL headers have been added. Issues with business      parameter passing have been fixed by @tingbin-ctb in (#1325)
    - Update to version 3.3.14
     * feat(appmanager): add appmanager subcommand with PyPI+OSS      dual-source by @mengjunwei-mjw in (#1317)
     * {Misc} Add --name and update version check message for plugin      install and adjust agent detection by @AllyW in (#1316)
    - from version 3.3.13
    - Update to version 3.3.12
     * Add AgentBay CLI command and implement language setting logic      by @CodeSpaceiiii in (#1311)
     * {Profile} Add external-account-type for user profile      by @AllyW in (#1312)
     * Implement CLI mock command with add, import, remove, list,      clear, and path subcommands by @CodeSpaceiiii in (#1313)
     * {Openapi} Add agent segment to user-agent by @AllyW in (#1314)
    - from version 3.3.11
     * Fix retrySaveProfile function to return success status and      update tests by @CodeSpaceiiii in (#1310)
    - Update to version 3.3.10
    - from version 3.3.9
     * {Config} Add safety policy env parsing by @AllyW in (#1307)
    - from version 3.3.8
     * {Core} Add plugin install --package and plugin show by @AllyW in (#1301)
    - from version 3.3.7
     * {config} Fix: Only honor ALIBABA_CLOUD_ENDPOINT for profile      endpoint env injection by @AllyW in (#1304)
    - from version 3.3.6
     * {Core} Fix endpoint shorthand flag -e of oss by @AllyW in (#1303)
    - from version 3.3.5
     * feat: profile support endpoint flag by @crimson-gao in (#1298)
     * {Core} Add aliyun upgrade and configurable plugin index source and      fix CloudSSO/OAuth one-off CLI flags persisting by @AllyW in (#1299)
    - Update to version 3.3.4
     * {Core} Fix unknown-flag parsing for plugin-style subcommands      by @AllyW in (#1296)
    - from version 3.3.3
     * {Core} Add ai-mode and safety policy configuration      by @AllyW in (#1295)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow
    vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a
    dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently
    called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer
    arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.
    (CVE-2026-63209)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22117-1 advisory.

    Changes in cadvisor:

    - update to 0.60.6:
      * workflows: mirror release tags to lib/ module tags
      * fs/zfs: fall back to VFS when zfs stats are unavailable
      * storage/stdout: nil-check Cpu, Network, and Memory stats
      * Treat memory-only NUMA nodes as valid topology
    - update vendor.tar to fix
      * bsc#1283657, CVE-2026-63209: cadvisor:
        github.com/klauspost/compress: signed integer overflow in         s2.NewDict()

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22116-1 advisory.

    Changes in hauler:

    - update to 2.1.1:
      * bumped go version to v1.26.7 (backport #771)
      * https registry auth fix (backport #763)
      * adjust supporting artifact retrieval (backport #777)
      * reject --platform on digest-pinned multi-platform images
      * fix: serve registry returns an empty /v2/_catalog list
      * added airgapped support for install.sh and added windows         install.ps1
      * added/fixed basic auth with registry and fileserver
      * fixed store inventory race with concurrent processes
      * added type filter to store copy
      * fixed missing dirs in containers
      * updated github workflows with versions, permissions, and         concurrency

    - update vendor.tar to fix:
      * bsc#1280110, CVE-2026-53495

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4662-1 advisory.

    This update for amazon-cloudwatch-agent fixes the following issue:

    - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an     attacker to bypass       repeat index validation and cause a process crash (bsc#1283594).

    Changes for amazon-cloudwatch-agent:

    Update to version 1.300073.0

     * [Agent] Add Google Cloud support for GCE and GKE by @jefchien      in (#2255), (#2258) and (#2260)
     * [Agent] Add opt-in self-telemetry endpoint for agent metrics      by @movence in (#2246)
     * [ContainerInsights] Add KEDA and Karpenter metrics scraping      by @Paamicky in (#2250)
     * [ContainerInsights] Add watch_replicaset toggle to disable the      ReplicaSet informer by @movence in (#2246)
     * [Metrics/JMX] Format JVM metric units for Tomcat by @Paamicky      in (#2235)
     * [ContainerInsights] Fix EKS OTel Container Insights log delivery      and stabilize cluster-scoped metric identity by @sky333999      in (#2249)
     * [ContainerInsights] Only resolve cluster name when running      in Kubernetes by @Paamicky in (#2259)
     * [Logs] Prevent high log throughput from stalling log collection      while recording file read progress by @lorespiz in (#2253)
    - Update github.com/klauspost/compress to v1.18.7      (bsc#1283594, CVE-2026-63209)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4661-1 advisory.

    This update for google-osconfig-agent fixes the following issue:

    - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an     attacker to bypass       repeat index validation and cause a process crash (bsc#1283672).

    Changes for google-osconfig-agent:

    Update to version 20260928.01

     * scalibr linux new metadata support (#1038)
     * Fix failing to report REBOOTING state during postPatchReboot      due to context canceled for Windows VMs (#1055)
     * Fix os/snap extractor usage (#1053)
    - Update github.com/klauspost/compress to v1.18.7      (bsc#1283672, CVE-2026-63209)
     * bump grpc package to new version (#1057)
     * bump some dependencies across few modules (#1056)
    - Update github.com/klauspost/compress to v1.18.7      (bsc#1283672, CVE-2026-63209)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22039-1 advisory.

    This update for distribution fixes the following issue:

    - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an     attacker to bypass       repeat index validation and cause a process crash (bsc#1283762).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4554-1 advisory.

    This update for google-osconfig-agent fixes the following issue:

    - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an     attacker to bypass       repeat index validation and cause a process crash (bsc#1283672).

    Changes for google-osconfig-agent:

    Update to version 20260928.01

     * scalibr linux new metadata support (#1038)
     * Fix failing to report REBOOTING state during postPatchReboot      due to context canceled for Windows VMs (#1055)
     * Fix os/snap extractor usage (#1053)
    - Update github.com/klauspost/compress to v1.18.7      (bsc#1283672, CVE-2026-63209)
     * bump grpc package to new version (#1057)
     * bump some dependencies across few modules (#1056)
    - Update github.com/klauspost/compress to v1.18.7      (bsc#1283672, CVE-2026-63209)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow     vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a     dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently     called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer     arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.
    (CVE-2026-63209)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
370417	openSUSE 16 Security Update : gh (openSUSE-SU-2026:22134-1)	Nessus	SuSE Local Security Checks	Local	high
370414	openSUSE 16 Security Update : aliyun-cli (openSUSE-SU-2026:22140-1)	Nessus	SuSE Local Security Checks	Local	high
476354	SCA: security update for github.com/klauspost/compress (GHSA-259r-337f-4rfw)	Tenable Cloud Security	SCA Checks	Local	high
476354	SCA: security update for github.com/klauspost/compress (GHSA-259r-337f-4rfw)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
367243	openSUSE 16 Security Update : cadvisor (openSUSE-SU-2026:22117-1)	Nessus	SuSE Local Security Checks	Local	high
367237	openSUSE 16 Security Update : hauler (openSUSE-SU-2026:22116-1)	Nessus	SuSE Local Security Checks	Local	medium
366070	SUSE SLES15 Security Update : amazon-cloudwatch-agent (SUSE-SU-2026:4662-1)	Nessus	SuSE Local Security Checks	Local	high
366058	SUSE SLES15 Security Update : google-osconfig-agent (SUSE-SU-2026:4661-1)	Nessus	SuSE Local Security Checks	Local	high
364342	openSUSE 16 Security Update : distribution (openSUSE-SU-2026:22039-1)	Nessus	SuSE Local Security Checks	Local	high
364128	SUSE SLES12 Security Update : google-osconfig-agent (SUSE-SU-2026:4554-1)	Nessus	SuSE Local Security Checks	Local	high
358378	Linux Distros Unpatched Vulnerability : CVE-2026-63209	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-63209

high

Tenable Plugins

Coming Soon

high

high

high

high

high

medium

high

high

high

high

high