compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.

suse_linux SUSE-SU-2026:5203-1: SUSE SLED15 / SLES15 : Security update for alloy (Important) (SUSE-SU-2026:5203-1)

suse_linux SUSE-SU-2026:5195-1: SUSE SLES15 : Security update for aliyun-cli (Important) (SUSE-SU-2026:5195-1)

suse_linux SUSE-SU-2026:5202-1: SUSE SLES15 : Security update for distribution (Important) (SUSE-SU-2026:5202-1)

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5119-1 advisory.

    - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an     attacker to bypass       repeat index validation and cause a process crash (bsc#1283642).
    - CVE-2026-78669: golang.org/x/net/http2: excessive CPU consumption from repeated initial window changes     (bsc#1285273).
    - CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS     certificate bypass       allows log telemetry interception and alteration (bsc#1281468).
    - CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-     driven log emission       (bsc#1281469).
    - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows     internal network       probing (bsc#1281112).

    Changes for helm:

    - Update to version 3.22.1

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22224-1 advisory.

    Changes in rqlite:

    - Update to version 10.6.6:
      * Keep the local auto-backup file if the metadata rename fails
      * Reject local auto-backup filenames reserved for internal use
      * POST /demote and POST /promote return a JSON error body, and         404 when the target node is not in the cluster.
      * DELETE /remove returns a JSON error body.
    - Includes changes from  version 10.6.5:
      * Guard the inter-node backup stream handler directly against a         missing backup request
      * POST /leader returns a JSON error body, and 404 when the target         node is not in the cluster

    - Update to version 10.6.4:
      * BACKUP_STREAM authorization failures can disclose the database         and crash rqlited (boo#1286934)
      * GET /leader returns a JSON error body when there is no leader
      * Close the connection after rejecting an unauthorized inter-node         backup stream request, instead of streaming the database anyway
      * Decide inter-node command authorization once, before dispatch,         and close the connection after rejecting any unauthorized         command

    - Update to version 10.6.3:
      * Node probes honor request context and commit exactly one         result
      * Make DB connections a first-class object
      * Prevent ATTACH on the query database connection

    - Update to version 10.6.2:
      * Check for trailing junk in request bodies
      * Console schema view handles table names that collide with         JavaScript object properties
      * Set CommitTimestamps in CDC Events Group
      * Upgrade dependencies

    - Update to version 10.6.1:
      * Use constant-time comparison when comparing passwords
      * Conditionally rewrite SQL during queued writes and fix         rewriting of CURRENT_TIMESTAMP and related tokens
      * More robust Leader stepdown node ID detection, reap checks,         and SQL analyze start-time recording
      * CDC fixes: encode non-finite floats, always release flush         waiters, and make the HTTP sink follow redirects
      * Converted _service from mode=disabled to mode=manual (legacy         leftover; services are run by hand via osc service manualrun)
      * Package is not affected by CVE-2026-84445 (boo#1278793),         CVE-2026-84304 (boo#1279102), CVE-2026-84303 (boo#1279253):
        vendored grpc is v1.84.0, above the v1.83.1/v1.83.2 fixes
      * Package is not affected by CVE-2026-89090 (boo#1280657):
        vendored eventstream is v1.7.20, above the v1.7.8 fix
      * Package is not affected by CVE-2026-63209 (boo#1283555):
        vendored klauspost/compress is v1.20.1, above the v1.18.7         fix
      * Package is not affected by CVE-2026-39821 (boo#1266544):
        vendored golang.org/x/net is v0.59.0, above the v0.55.0         fix

    - Update to version 10.6.0:
      * API addition: error_v2 may contain numeric SQLite error codes.
      * addresses a security issue related to Authentication files. A         user with no explicit permissions could be grant elevated         permissions. Correctly configured users do not suffer from this         issue.
      * multiple implementation changes and bug fixes
      * Display interactive cluster topology on web console.
      * Support configurable queued-writes retries
      * release addresses a gap in the role-based access permissions         related to change-data-capture (CDC) handling

    - Update to version 10.3.6:
      * Add query logging to database layer
      * Snapshot IDs now contain (optional) generation
      * Bump generation ID if snapshot IDs collide
      * Snapshots can be filtered by term and index
      * Add support for File Renaming and Removing with retries
      * Replace standard library with fsutil
      * Keep snapshot ordering correct regardless of clock
      * Remove snapshot name generation ID

    - Update to version 10.3.5:
      * Reject alternate form of unsupported PRAGMA commands
      * Handle negative trailing logs
      * Sync access to last backup time at http layer
      * Set the Served by header before first backup byte
      * Set DB load response time for all formats
      * Fix HTTP logic error for queued statements
      * Minor web console fixes
    - includes changes from 10.0.4:
      * Do not emit rolled-back events over CDC
    - includes changes from 10.0.3:
      * Refactor busy timeout methods
      * Fix edge-case bugs detected by GPT-6 Astra
      * Switch to quay.io/minio/minio:latest for testing purposes
      * Fix removing a node with different ID, but same Raft address
      * Use correct Foreign Key setting when recovering node
      * Only dump the indexes and triggers of the selected tables
      * Detect DB changes during Request(RETURNING)
      * Snapshot Open() first checks for failed reap
      * Sync snapshot plan directory
      * Propagate WAL stat errors
      * Clean up cancelled snapshots
      * Reject incomplete snapshot headers
      * Validate restore database header
      * Only reap a sole fullsnapshot if it has zero WALs
      * Keep database dumps consistent during writes to the database
      * Roll back DB Requests on statement-prepare errors
    - includes changes from 10.0.2:
      * Upgrade SQLite driver
      * Unit test reaping an installed Snapshot and streamed Snapshot combo
      * Use distinct Snapshot Namer type
      * Replace breaking-pragma regexes with ASCII prefix scanning
      * Consolidate pragma and txStatus reads onto a single connection per pool
      * Fix some magic strings in db package

    - Update to version 10.3.1:
      * Consolidate SQLite driver construction
      * Plumb Term and Index through during Snapshot Restore
      * Hard exit if FSM Restore fails post database-swap

    - Update to version 10.3.0:
      * Console app supports quickly querying for first 100 rows of a         table
      * Rename read-only nodes to read replicas. Command-line flags         unchanged
      * Bundles dependencies updated
      * Add infra for pushing OTLP metrics to an OpenTelemetry         Collector
      * Add query logging at database level
      * Add CopyDir functionality to file utils.
      * Add ability to clone Snapshots, primarily for testing purposes
      * Store Index and Term in Fingerprint file and check during         start-up

    - Update to version 10.2.7:
      * Remove explicit database-level read-only check from the pure         Query path
      * Miscellaneous Store-level fixes related to resource management         and shutdown sequence
      * Don't run CRC checks twice on Snapshot when fast-restart is         explicitly disabled
      * Fixes to the http package including SQL rewriting control.
      * Address potential dropped CDC event on restart
      * Various minor fixes
     - includes changes from 10.2.6:
      * Handle a fully-executed Reap plan, but Plan file itself not         removed
      * Close Snapshot streamer on error.
    - includes changes from 10.2.5:
      * Perform a Quick Integrity check after reaping snapshots, not         Full

    - Update to version 10.2.4:
      * Fix some non-AWS S3-compatible stores
    - includes changes from 10.2.3
      * Check snapshot store integrity before first actual use
      * Disable HTTP timeout for boot and restore operations via the shell
      * HTTP layer ignores ErrNoWALToSnapshot when snapshotting
      * Close Snapshot Streamer ASAP when restoring to local node

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22227-1 advisory.

    Changes in go-containerregistry:

    - update vendor.tar to address:
      * bsc#1288488, CVE-2026-116591: github.com/klauspost/compress/zstd:
        crafted ~27 KB two-block zstd frame makes DecodeAll and the         streaming decoder panic

    - update to 0.22.1:
      * Reject non-canonical IP literals in all SSRF guards
      * daemon: fix stale docker/docker reference in WithClient docs
      * build(deps): bump the go-deps group across 2 directories with         4 updates
      * authn: do not overwrite AuthConfig.Auth when username and         password are empty
      * build(deps): bump the actions group across 1 directory with 8         updates
      * Support pulling images by sha512 digest
      * Allow empty label and annotation values in crane mutate
      * fix(build): Use dependencies.gitSource in cloudbuild_v2.yaml
      * validate: support index attestation manifests and empty         configs
      * name: improve error when parsing a reference with a URL         scheme
      * fix(build): install binaries to /ko-app and add to PATH
      * fix(release): honor declared Go toolchain
      * remote: apply checkRedirectSSRF to writer-side HTTP clients
      * flatten: preserve config and layer media types when         flattening
      * fix(mutate): make Time layer updates lazy
      * build(deps): bump the go-deps group across 2 directories with         3 updates
      * remote: copy manifest annotations to referrers fallback tag         descriptors

    - update to 0.22.0:
      * mutate: let Time and Canonical take tarball.LayerOption
      * build: add multi-architecture Cloud Build configurations for         crane, gcrane, and krane
      * remote: resolve push-check credentials against the repository
      * Allow single-character repository paths
      * fix: add missing substitutions and workspace cleanup to new         build files
      * remote: retry failed Puller and Pusher initialization
      * build(deps): bump the actions group across 1 directory with 8         updates
      * build(deps): bump the go-deps group across 1 directory with 3         updates
      * go.mod: bump Go version + add toolchain directive to replace         .go-version file
      * fix: Fix new build options and provenance
      * fix(build): unify new build flow into cloudbuild_v2.yaml

    - update to 0.21.8 (bsc#1283692, CVE-2026-63209):
      * The artifacts attached to this release are missing SLSA         provenance, see #2390.
      * build(deps): bump the go-deps group across 1 directory with 3         updates
      * build(deps): bump golang.org/x/crypto from 0.45.0 to 0.52.0         in /cmd/krane
      * build(deps): bump golang.org/x/crypto from 0.50.0 to 0.52.0         in /pkg/authn/k8schain
      * build(deps): bump golang.org/x/net from 0.49.0 to 0.55.0 in         /pkg/authn/kubernetes
      * build(deps): bump the go-deps group across 3 directories with         7 updates
      * build(deps): bump the actions group across 1 directory with 5         updates
      * Reject unsafe Windows archive paths in Extract
      * feat(goreleaser): add loong64 build support for         crane/gcrane/krane
      * Document tag and digest reference semantics
      * remote: release pull limiter slot when body is read to EOF
      * tarball: bounds-check layer index in uncompressed         LayerByDiffID
      * authn: read Podman auth from XDG config
      * transport: per-host bearer token exchange on cross-host         redirect
      * mutate: bounds-check layer index when building rebase         addendums
      * fix(daemon): copy ExposedPorts from source config in         computeImageConfig
      * feat(remote): add WithReferrersTagFallback option
      * mutate: apply opaque-directory whiteouts (.wh..wh..opq) in         Extract
      * tarball: use correct file extension for zstd/uncompressed
      * build(deps): bump github.com/moby/moby/client from 0.5.0 to         0.5.1 in the go-deps group across 1 directory
      * actions: update actions to be pinned by hash
      * Bump go version to 1.26.5

    - update to 0.21.7:
      * tarball: return error instead of panicking on missing         rootfs.diff_ids
      * gcrane: honor --platform flag in copy
      * mutate: verify layer digests in Extract and Time
      * tarball: close layer readers during Write
      * build(deps): bump the actions group across 1 directory with 2         updates
      * build(deps): bump github.com/docker/cli from         29.4.3+incompatible to 29.5.2+incompatible in the go-deps         group across 1 directory
      * BUGFIX: Fail with error when read exceeds maximum
      * build(deps): bump the actions group across 1 directory with 2         updates
      * fix(name): anchor loopback registry detection
      * Reject symlinks in OCI layout blobs
      * fix(crane): avoid creating export tar on pull failure
      * feat(kubernetes): allow ignoring pull secrets
      * fix(name): preserve localhost registry references
      * pkg/registry: export ErrNotFound
      * pkg/registry: export RedirectError
      * build(deps): bump the go-deps group across 1 directory with 2         updates
      * build(deps): bump the actions group across 1 directory with 2         updates
      * fix: prevent SSRF in google.List() pagination
      * internal/gzip: fix goroutine leak in ReadCloserLevel
      * fix(transport): apply refreshed bearer token after cross-host         redirect
      * build(deps): bump the go-deps group across 3 directories with         4 updates
      * fix(tarball): normalize paths when matching files
      * transport: do not re-attach bearer token after cross-host         redirect
      * Bump CI go version to 1.26.4
    - update to 0.21.6:
      * fix: update dependencies to use new azure sdk components
      * transport: restore resp.Body in retryError so CheckError can         parse it
      * pkg/registry: return 202 Accepted for PATCH chunk uploads
      * Follow OCI distribution spec for artifactType and annotations
      * actions: attach Codecov token to coverage tests on main
      * remote: use DeleteScope (with delete action) for manifest         deletion
      * remote: limit concurrent layer pulls
      * pkg/registry: reject corrupt disk blobs
      * mutate: close layer readers during export
      * crane/flatten: preserve image media type when flattening
      * build(deps): bump goreleaser/goreleaser-action from 7.0.0 to         7.2.1 in the actions group across 1 directory
      * build(deps): bump go.opentelemetry.io/otel from 1.36.0 to         1.41.0
      * build(deps): bump the go-deps group across 3 directories with         6 updates
      * Replace go-homedir with os.UserHomeDir
      * pkg/name: only treat .localhost as non-HTTPS, not .local
      * transport: block unspecified IPs (0.0.0.0, ::) in         validateRealmURL
      * test(mutate): add Extract round-trip test for filesystem         object preservation
      * experiments: remove deprecated support for estargz
      * build(deps): bump aws-actions/configure-aws-credentials from         6.1.0 to 6.1.1 in the actions group
      * fix: limit HTTP response body reads to prevent OOM
      * build(deps): bump the go-deps group across 3 directories with         6 updates
      * transport: block redirects from token server to private/link-         local addresses (SSRF fix)
      * pkg/v1/mutate: preserve relative symlinks that stay within         rootfs in Extract
      * validate: skip non-layer layers
      * remote: validate foreign layer URLs to prevent SSRF (fixes         #2259)
      * remote: block SSRF via private-IP Location headers in blob         uploads
      * fix(mutate): preserve config blob and layers for non-Docker         OCI artifacts
      * fix: preserve per-occurrence layer identity in         mutate.Image.Layers()
      * transport: retry HTTP 429 (Too Many Requests)
      * transport: allow bearer realm at same host:port as registry
      * Update go version to 1.26.3
    - update to 0.21.5:
      * Bump docker/cli v29.4.0, moby/api v1.54.1, moby/client v0.4.0
      * update to Go 1.26.2
      * Bump aws-actions/configure-aws-credentials from 6.0.0 to         6.1.0 in the actions group across 1 directory
      * build(deps): bump golang.org/x/tools from 0.43.0 to 0.44.0 in         the go-deps group across 1 directory
      * **Full Changelog**: https://github.com/google/go-         containerregistry/compare/v0.21.4...v0.21.5
    - update to 0.21.4:
      * go.mod: do not make a viral minimum go version
      * Avoid pruning absolute links from extracted and flattened         images
      * Bump the go-deps group across 3 directories with 5 updates
      * fix: update to go1.25.8, and use separate .go-version file
      * Bump CI go version to 1.26.1
      * Bump codecov/codecov-action from 5.5.2 to 5.5.3 in the         actions group
      * fork distribution client v3 auth-challenge as an internal         package (squashed)
      * transport: validate Bearer realm URL to prevent SSRF
      * revert path traversal and symlink escape from #2227
      * Fix pkg/v1/google/auth tests for arm64
      * goreleaser: Update goreleaser config and GH action

    - update to 0.21.3:
      * Adds local file support to the `crane index` subcommand
      * migrate to github.com/moby/moby modules
      * Bump the go-deps group across 4 directories with 7 updates
      * Bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 in the         actions group
      * mutate: reject path traversal and symlink escape in Extract
      * tarball: detect symlink cycles in extractFileFromTar
      * bump golang to 1.25.7
    - update to 0.21.2:
      * Better handle redirects to https in ping
      * **Full Changelog**: https://github.com/google/go-         containerregistry/compare/v0.21.1...v0.21.2

    - update to 0.21.1:
      * Add WithFileBufferedOpener for file-backed daemon image         buffering
      * crane: fix case in auth response json
    - update to 0.21.0:
      * fix(mutate): don't skip dir replacements via whiteout in         export
      * Improve performance of v1.NewHash
      * Bump the actions group across 1 directory with 4 updates
      * Bump the root-deps group across 1 directory with 7 updates
      * Fix error messages in crane_test.go
      * Bump go version across packages to 1.25.6
      * Join go.mod dependency updates
      * Bump the go-deps group across 3 directories with 3 updates
      * Disable taint gosec lints
      * Update go version used in goreleaser
    - update to 0.20.7:
      * Fix ArgsEscaped lint directive
      * transport: Fix broken links to distribution docs
      * fix(remote): using customized retry predicate func if         provided
      * Adding docker file
      * crane: Add timestamp to flatten layer
      * feat(remote): pass retryBackoff option to transport
      * Expose clobber refusal error
      * Build artifacts for riscv64
      * Update dependencies and deprecate DockerVersion field

    - update to 0.20.7:
      * Fix ArgsEscaped lint directive
      * transport: Fix broken links to distribution docs
      * fix(remote): using customized retry predicate func if         provided
      * Adding docker file
      * crane: Add timestamp to flatten layer
      * feat(remote): pass retryBackoff option to transport
      * Expose clobber refusal error
      * Build artifacts for riscv64
      * Update dependencies and deprecate DockerVersion field


    - update to 0.20.6:
      * Ensure that tag name is not empty if name contains colon
      * Bump some deps
    - update to 0.20.5:
      * build(deps): bump docker/docker to v28.0.0+incompatible
      * Migrate linter to v2
      * bump go version + bump deps
      * implement TextMarshaler/JSONMarshaler more consistently
      * Update CodeQL permissions
      * Update goreleaser permissions
      * Update provenance action in release
      * Update validator action

    - CVE-2025-22868: golang.org/x/oauth2/jws: Unexpected memory consumption       during token parsing in golang.org/x/oauth2 (bsc#1239277)

    - update to 0.20.3:
      * remote/transport: Make bearer transport go-routine-safe
      * Expose compare package
      * fix: redact.URL uses (*URL).Redacted to omit basic-auth         password
      * bump actions to latest
      * don't pin chainguard-dev/actions
      * Check for 406 status code when handling referrers API         endpoint response
      * mutate: Create a defensive annotations copy
      * Detect zstd in crane append
      * bump deps using hack/bump-deps.sh
    - update to 0.20.2:
      * deps: bump docker dep

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:24261-1 advisory.

    This update for aliyun-cli fixes the following issue:

    - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an     attacker to bypass       repeat index validation and cause a process crash (bsc#1283596).

    Changes for aliyun-cli:

    - Update to version 3.5.1
     * Add opt-in built-in OSS JSON/JSONL listings with bounded pages and resumable      cursors, structured errors with recovery guidance, and non-interactive      confirmation handling (#1452).
     * Add offline validation and read-only plans for single-file uploads and      single-object deletion; record exact failed targets in exclusive JSONL      manifests for cp/sync and expose sync deletion-phase state (#1452).
     * Fix the OSS bridge to preserve option order and `--`, propagate parser and      service errors, pass profile region/timeouts/retry budgets, and refresh host      credentials at request time without injecting them into argv (#1454).
     * Stop replaying writes after ambiguous transport or server failures; classify      retries with jittered backoff, join workers before closing reports, and fix      progress data races and failure-report filename collisions (#1452).
     * Enforce the host safety policy for legacy OSS operations and reject      unsupported preview combinations (#1452, #1454).
     * Harden policy parsing and environment overrides to fail closed on invalid      configuration; explicit deny rules cannot be bypassed by `--force`, `--yes`,      or AI mode.
     * Enforce the safety policy before built-in extension dispatch      (cliext/safety.go).
     * Restrict legacy FNF request-signing compatibility to a product allowlist (#1447).
     * API alias canonicalization was reverted and held: aliases and PascalCase/      kebab-case spellings remain separate policy matches, matching command      spelling exactly as typed.
     * Version AI-mode OpenAPI and OSS error envelopes with `schemaVersion: v1`,      and return structured startup configuration errors (#1453).
     * Add ALIBABA_CLOUD_CLI_AGENT_INTEGRATION controls for automatic AI mode;
     expand agent detection, User-Agent attribution, and Qoder China CLI      detection (#1445, #1455).
     * Support case-insensitive product routing for in-process OpenAPI commands (#1445).
     * Expose regional and VPC product endpoints through queryable product Help (#1448).
     * Support camel RPC flat arrays (#1456) and prefer product prefix/substring      suggestions over edit distance in Did you mean output.
     * Upgrade JMESPath to support `json.Number`, preserving large-number      comparison and sorting precision and fixing empty-array average semantics.
     * Dispatch newly installed metadata plugins in-process (#1439).
     * Harden plugin archive extraction, package replacement/rollback, and download      URL diagnostics (#1442).
     * Redact JSON and form bodies based on content while preserving the encoding      of original form stars; keep raw and unparseable dry-run bodies intact      (#1440, #1449).
     * Prefer native macOS architecture packages in install.sh (#1433).
     * Keep prerelease tags off the stable latest pointer and fail closed when      release asset downloads are incomplete (#1437).
     * Include cliext in required checks, fix cross-platform test failures (#1446),      restore single-file entrypoint builds, and stabilize language tests.
     * Update the aliyun-openapi-meta submodule and release jobs.
     * Add the OSS automation guide (en / zh-CN), document startup errors, exit      statuses and command-spelling safety matching (#1450), and add the v3.5.1      CHANGELOG entry.
    - from version 3.5.0
     * docs: add StsToken credential mode to README by @yndu13 in (#1403)
     * Built-in plugin and AI MODE enhancement by @yndu13 in (#1411)
     * Update Aliyun OpenAPI meta data
    - Update to version 3.4.11
     * feat(openapi): extend --estimate-cost coverage (pricing context,      SLS/openapi path, oss bridge, by-triple) and scripting contract      by @api-tool-agent in (#1399)
    - from version 3.4.10      (no changes)
    - from version 3.4.9
     * fix(maxc): fall back when symlink creation fails on Windows      by @yndu13 in (#1390)
     * fix: quote-aware External process_command parsing by @yndu13 in (#1391)
     * fix: POSIX line-continuation in External process_command splitting      by @yndu13 in (#1392)
     * Improve invalid flag error with did-you-mean hints by @yndu13 in (#1394)
     * fix: atomically write config.json via temp+rename by @yndu13 in (#1387)
     * fix: detect throttling by x-acs-retry-after header by @yndu13 in (#1395)
     * feat: add aliyun ecctl for Elastic Compute Control CLI by @yndu13 in (#1397)
     * fix: allow --profile with aliyun oss subcommands by @yndu13 in (#1398)
    - Update to version 3.4.8
     * fix(test): mock plugin index for offline-stable Windows CI by @yndu13 in (#1379)
     * fix: correct waiter timeout/interval range validation by @yndu13 in (#1382)
     * feat(openapi): add --cli-dry-run flag for built-in PascalCase commands      by @CodeSpaceiiii in (#1383)
     * fix: persist configure read-timeout as read_timeout by @yndu13 in (#1384)
     * fix: ignore empty --mode so env credentials still apply by @yndu13 in (#1386)
     * feat: add mseutil command to aliyun CLI by @yndu13 in (#1381)
     * fix(oss): honor profile endpoint and endpoint-type vpc by @yndu13 in (#1385)
     * fix: correct import order in openapi/library_test.go by @CodeSpaceiiii      with @Copilot in (#1388)
     * Fix invisible API parameter names in help output (bold-black on dark terminals)      by @mvanhorn in (#1362)
     * feat: integrate flow-cli into Aliyun CLI by @yndu13 in (#1380)
     * fix(esacli): harden exec override and shorthand flags by @yndu13 in (#1389)
    - from version 3.4.7
     * {plugin} Add alias support for plugin by @AllyW in (#1376)
     * feat(mock): add response_body_size for controllable mock stdout size      by @yndu13 in (#1378)
     * fix(plugin): prevent bulk update plugin pointer aliasing by @yndu13 in (#1377)
    - from version 3.4.6
     * feat(openapi): add --estimate-cost-context to pass PricingContext to quotes      by @LCLSpring in (#1373)
     * feat(mock): add delay_ms field to simulate command execution latency      by @yndu13 in (#1375)
    - Update to version 3.4.5
     * [Feature] Support ESA CLI Sub Command by @msyysm1211 in (#1345)
     * feat(config): support STS endpoint override for OIDC and role      auth by @yndu13 in (#1372)
    - from version 3.4.4
     * (no changes)
    - from version 3.4.3
     * fix: correct valid typo in invalid command error by @yndu13 in (#1365)
     * {Misc} Add ALIBABA_CLOUD_DISABLE_EXTERNAL_PROCESS to disable external      process by @AllyW in (#1366)
    - from version 3.4.2
     * feat(openapi): add --estimate-cost and list-supported-pricing-apis      by @LCLSpring in (#1364)
    - Update to version 3.4.1
     * [Feature]Add Aliyun Lindorm CLI Subcommand by @MistySoul in (#1361)
     * {cliext} Add aliyun spark-submit by @AllyW in (#1358)
    - from version 3.4.0
     * feat(acrutil): extract shared binary manager and add diagnosis      subcommand by @copyrightpoiiiii in (#1349)
     * [feature] add rostran sub command by @xiao201208 in (#1350)
     * {OpenAPI} Add --cli-dry-run-json by @AllyW in (#1306)
     * {Misc} Fix plugin three layer cmd help by @AllyW in (#1343)
     * Feature/support anonymous by @yuexiu94 in (#1354)
     * feat: support retry-after policy for throttling error by @yndu13      in (#1355)
    - Update to version 3.3.23
     * {Plugin} Allow plugins to opt out of host profile enforcement      by @AllyW in (#1348)
    - Update to version 3.3.22
     * {Logging} Skip list for self-built-gateway products by @AllyW in (#1346)
    - from version 3.3.21
     * {Configure} Match policy rules against the command users actually type      for ROA by @AllyW in (#1344)
    - from version 3.3.20
     * {OpenAPI} Add call context logging by @AllyW in (#1342)
    - from version 3.3.19
     * [Feature] Support MaxC CLI Sub Command by @dingxin-tech in (#1332)
     * feat(appmanager): Generalized PrepareEnv credential pass-through      supports multiple authentication modes by @mengjunwei-mjw in (#1341)
    - from version 3.3.18
     * Improve CMS2 command descriptions and clarify exception      return codes by @tingbin-ctb in (#1337)
     * feat(iact3): add iact3 subcommand with manual upgrade      by @xiao201208 in (#1336)
     * Add kmscli command by @oobujieshi in (#1340)
    - from version 3.3.17
     * {Plugin} Support lang and profile from flag for plugin      execution by @AllyW in (#1330)
     * Computenest pypi venv by @mengjunwei-mjw in (#1331)
     * feat: add codeup-cli subcommand for migrating third-party      code repos by @imu2008 in (#1335)
    - from version 3.3.16
     * Optimize error messages by @CodeSpaceiiii in (#1327)
     * {Openapi} Return InvalidApiError for unknown API on      restful products by @AllyW in (#1326)
     * feat(acrutil): Add Alibaba Cloud Container Registry(ACR)      Skill management CLI subcommand by @copyrightpoiiiii in (#1329)
     * {Configure} Support BearerToken profile mode by @AllyW in (#1333)
    - from version 3.3.15
     * feat add saectl by @Beimingx in (#1319)
     * Cloud Monitor version 2.0: Independent binary access,      Aliyun CMS2 subcommands by @thinkbetter18 in (#1322)
     * feat(otel): integrate OpenTelemetry support with environment      variable by @CodeSpaceiiii in (#1324)
     * aliyuncms has been renamed to aliyuncms2. COMPAT_MODE, USER_AGENT,      AI_USER_AGENT, and OTEL headers have been added. Issues with business      parameter passing have been fixed by @tingbin-ctb in (#1325)
    - Update to version 3.3.14
     * feat(appmanager): add appmanager subcommand with PyPI+OSS      dual-source by @mengjunwei-mjw in (#1317)
     * {Misc} Add --name and update version check message for plugin      install and adjust agent detection by @AllyW in (#1316)
    - from version 3.3.13
    - Update to version 3.3.12
     * Add AgentBay CLI command and implement language setting logic      by @CodeSpaceiiii in (#1311)
     * {Profile} Add external-account-type for user profile      by @AllyW in (#1312)
     * Implement CLI mock command with add, import, remove, list,      clear, and path subcommands by @CodeSpaceiiii in (#1313)
     * {Openapi} Add agent segment to user-agent by @AllyW in (#1314)
    - from version 3.3.11
     * Fix retrySaveProfile function to return success status and      update tests by @CodeSpaceiiii in (#1310)
    - Update to version 3.3.10
    - from version 3.3.9
     * {Config} Add safety policy env parsing by @AllyW in (#1307)
    - from version 3.3.8
     * {Core} Add plugin install --package and plugin show by @AllyW in (#1301)
    - from version 3.3.7
     * {config} Fix: Only honor ALIBABA_CLOUD_ENDPOINT for profile      endpoint env injection by @AllyW in (#1304)
    - from version 3.3.6
     * {Core} Fix endpoint shorthand flag -e of oss by @AllyW in (#1303)
    - from version 3.3.5
     * feat: profile support endpoint flag by @crimson-gao in (#1298)
     * {Core} Add aliyun upgrade and configurable plugin index source and      fix CloudSSO/OAuth one-off CLI flags persisting by @AllyW in (#1299)
    - Update to version 3.3.4
     * {Core} Fix unknown-flag parsing for plugin-style subcommands      by @AllyW in (#1296)
    - from version 3.3.3
     * {Core} Add ai-mode and safety policy configuration      by @AllyW in (#1295)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22134-1 advisory.

    Changes in gh:

    - Update to version 2.102.0, fixing four security issues       (GHSA-39wj-f2f4-978v, GHSA-4mq3-hpgx-9cx8, GHSA-qcwj-mr2r-2cx7,       GHSA-wjmr-j3rp-mh2g):

      * gh release/run/attestation download and repo read-file --output         could write to an unintended file through symbolic links
      * gh attestation verify compared --source-ref case-insensitively
      * gh attestation verify matched --signer-workflow only by prefix
      * gh skill search could inject options into gh skill install
      * Copy auth codes to the clipboard by default (gh config set         clipboard disabled to opt out)
      * Remove the gh repo garden command and the multi-account migration
      * Use API SSH URLs for repository clones
      * Validate repository names during interactive creation
      * Fix remote branch deletion on owner case mismatch
      * Propagate the gh path to extensions
      * Allow ghu_ tokens to attach files
      * Allow gh repo set-default --unset without an argument
      * Bump go-gh to 2.16.1, golang.org/x/crypto to 0.57.0,         github.com/klauspost/compress to 1.20.1 and Go to 1.27.1
    - Update golang.org/x/net to 0.60.0 to fix       excessive CPU consumption on repeated HTTP/2 initial window       changes (CVE-2026-78669, bsc#1285291).
    - Require golang(API) >= 1.27 as upstream moved to Go 1.27.
    - Not affected, vendored dependencies are above the fixed version:
      * CVE-2026-84445 (bsc#1278962): grpc is 1.83.2, fixed in 1.83.2
      * CVE-2026-84304 (bsc#1279208), CVE-2026-84303 (bsc#1279310):
        grpc is 1.83.2, fixed in 1.83.1
      * CVE-2026-41178 (bsc#1276707): otel/baggage is 1.44.0, fixed in         1.44.0
      * CVE-2026-63209 (bsc#1283727): klauspost/compress is 1.20.1,         contains the fix of 1.18.7
      * CVE-2026-72924 (bsc#1276755): gh is above 2.98.0, the fixed         version
      * CVE-2026-59831 (bsc#1271215): gh is above 2.95.0, the last         affected version

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22140-1 advisory.

    This update for aliyun-cli fixes the following issue:

    - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an     attacker to bypass       repeat index validation and cause a process crash (bsc#1283596).

    Changes for aliyun-cli:

    - Update to version 3.5.1
     * Add opt-in built-in OSS JSON/JSONL listings with bounded pages and resumable      cursors, structured errors with recovery guidance, and non-interactive      confirmation handling (#1452).
     * Add offline validation and read-only plans for single-file uploads and      single-object deletion; record exact failed targets in exclusive JSONL      manifests for cp/sync and expose sync deletion-phase state (#1452).
     * Fix the OSS bridge to preserve option order and `--`, propagate parser and      service errors, pass profile region/timeouts/retry budgets, and refresh host      credentials at request time without injecting them into argv (#1454).
     * Stop replaying writes after ambiguous transport or server failures; classify      retries with jittered backoff, join workers before closing reports, and fix      progress data races and failure-report filename collisions (#1452).
     * Enforce the host safety policy for legacy OSS operations and reject      unsupported preview combinations (#1452, #1454).
     * Harden policy parsing and environment overrides to fail closed on invalid      configuration; explicit deny rules cannot be bypassed by `--force`, `--yes`,      or AI mode.
     * Enforce the safety policy before built-in extension dispatch      (cliext/safety.go).
     * Restrict legacy FNF request-signing compatibility to a product allowlist (#1447).
     * API alias canonicalization was reverted and held: aliases and PascalCase/      kebab-case spellings remain separate policy matches, matching command      spelling exactly as typed.
     * Version AI-mode OpenAPI and OSS error envelopes with `schemaVersion: v1`,      and return structured startup configuration errors (#1453).
     * Add ALIBABA_CLOUD_CLI_AGENT_INTEGRATION controls for automatic AI mode;
     expand agent detection, User-Agent attribution, and Qoder China CLI      detection (#1445, #1455).
     * Support case-insensitive product routing for in-process OpenAPI commands (#1445).
     * Expose regional and VPC product endpoints through queryable product Help (#1448).
     * Support camel RPC flat arrays (#1456) and prefer product prefix/substring      suggestions over edit distance in Did you mean output.
     * Upgrade JMESPath to support `json.Number`, preserving large-number      comparison and sorting precision and fixing empty-array average semantics.
     * Dispatch newly installed metadata plugins in-process (#1439).
     * Harden plugin archive extraction, package replacement/rollback, and download      URL diagnostics (#1442).
     * Redact JSON and form bodies based on content while preserving the encoding      of original form stars; keep raw and unparseable dry-run bodies intact      (#1440, #1449).
     * Prefer native macOS architecture packages in install.sh (#1433).
     * Keep prerelease tags off the stable latest pointer and fail closed when      release asset downloads are incomplete (#1437).
     * Include cliext in required checks, fix cross-platform test failures (#1446),      restore single-file entrypoint builds, and stabilize language tests.
     * Update the aliyun-openapi-meta submodule and release jobs.
     * Add the OSS automation guide (en / zh-CN), document startup errors, exit      statuses and command-spelling safety matching (#1450), and add the v3.5.1      CHANGELOG entry.
    - from version 3.5.0
     * docs: add StsToken credential mode to README by @yndu13 in (#1403)
     * Built-in plugin and AI MODE enhancement by @yndu13 in (#1411)
     * Update Aliyun OpenAPI meta data
    - Update to version 3.4.11
     * feat(openapi): extend --estimate-cost coverage (pricing context,      SLS/openapi path, oss bridge, by-triple) and scripting contract      by @api-tool-agent in (#1399)
    - from version 3.4.10      (no changes)
    - from version 3.4.9
     * fix(maxc): fall back when symlink creation fails on Windows      by @yndu13 in (#1390)
     * fix: quote-aware External process_command parsing by @yndu13 in (#1391)
     * fix: POSIX line-continuation in External process_command splitting      by @yndu13 in (#1392)
     * Improve invalid flag error with did-you-mean hints by @yndu13 in (#1394)
     * fix: atomically write config.json via temp+rename by @yndu13 in (#1387)
     * fix: detect throttling by x-acs-retry-after header by @yndu13 in (#1395)
     * feat: add aliyun ecctl for Elastic Compute Control CLI by @yndu13 in (#1397)
     * fix: allow --profile with aliyun oss subcommands by @yndu13 in (#1398)
    - Update to version 3.4.8
     * fix(test): mock plugin index for offline-stable Windows CI by @yndu13 in (#1379)
     * fix: correct waiter timeout/interval range validation by @yndu13 in (#1382)
     * feat(openapi): add --cli-dry-run flag for built-in PascalCase commands      by @CodeSpaceiiii in (#1383)
     * fix: persist configure read-timeout as read_timeout by @yndu13 in (#1384)
     * fix: ignore empty --mode so env credentials still apply by @yndu13 in (#1386)
     * feat: add mseutil command to aliyun CLI by @yndu13 in (#1381)
     * fix(oss): honor profile endpoint and endpoint-type vpc by @yndu13 in (#1385)
     * fix: correct import order in openapi/library_test.go by @CodeSpaceiiii      with @Copilot in (#1388)
     * Fix invisible API parameter names in help output (bold-black on dark terminals)      by @mvanhorn in (#1362)
     * feat: integrate flow-cli into Aliyun CLI by @yndu13 in (#1380)
     * fix(esacli): harden exec override and shorthand flags by @yndu13 in (#1389)
    - from version 3.4.7
     * {plugin} Add alias support for plugin by @AllyW in (#1376)
     * feat(mock): add response_body_size for controllable mock stdout size      by @yndu13 in (#1378)
     * fix(plugin): prevent bulk update plugin pointer aliasing by @yndu13 in (#1377)
    - from version 3.4.6
     * feat(openapi): add --estimate-cost-context to pass PricingContext to quotes      by @LCLSpring in (#1373)
     * feat(mock): add delay_ms field to simulate command execution latency      by @yndu13 in (#1375)
    - Update to version 3.4.5
     * [Feature] Support ESA CLI Sub Command by @msyysm1211 in (#1345)
     * feat(config): support STS endpoint override for OIDC and role      auth by @yndu13 in (#1372)
    - from version 3.4.4
     * (no changes)
    - from version 3.4.3
     * fix: correct valid typo in invalid command error by @yndu13 in (#1365)
     * {Misc} Add ALIBABA_CLOUD_DISABLE_EXTERNAL_PROCESS to disable external      process by @AllyW in (#1366)
    - from version 3.4.2
     * feat(openapi): add --estimate-cost and list-supported-pricing-apis      by @LCLSpring in (#1364)
    - Update to version 3.4.1
     * [Feature]Add Aliyun Lindorm CLI Subcommand by @MistySoul in (#1361)
     * {cliext} Add aliyun spark-submit by @AllyW in (#1358)
    - from version 3.4.0
     * feat(acrutil): extract shared binary manager and add diagnosis      subcommand by @copyrightpoiiiii in (#1349)
     * [feature] add rostran sub command by @xiao201208 in (#1350)
     * {OpenAPI} Add --cli-dry-run-json by @AllyW in (#1306)
     * {Misc} Fix plugin three layer cmd help by @AllyW in (#1343)
     * Feature/support anonymous by @yuexiu94 in (#1354)
     * feat: support retry-after policy for throttling error by @yndu13      in (#1355)
    - Update to version 3.3.23
     * {Plugin} Allow plugins to opt out of host profile enforcement      by @AllyW in (#1348)
    - Update to version 3.3.22
     * {Logging} Skip list for self-built-gateway products by @AllyW in (#1346)
    - from version 3.3.21
     * {Configure} Match policy rules against the command users actually type      for ROA by @AllyW in (#1344)
    - from version 3.3.20
     * {OpenAPI} Add call context logging by @AllyW in (#1342)
    - from version 3.3.19
     * [Feature] Support MaxC CLI Sub Command by @dingxin-tech in (#1332)
     * feat(appmanager): Generalized PrepareEnv credential pass-through      supports multiple authentication modes by @mengjunwei-mjw in (#1341)
    - from version 3.3.18
     * Improve CMS2 command descriptions and clarify exception      return codes by @tingbin-ctb in (#1337)
     * feat(iact3): add iact3 subcommand with manual upgrade      by @xiao201208 in (#1336)
     * Add kmscli command by @oobujieshi in (#1340)
    - from version 3.3.17
     * {Plugin} Support lang and profile from flag for plugin      execution by @AllyW in (#1330)
     * Computenest pypi venv by @mengjunwei-mjw in (#1331)
     * feat: add codeup-cli subcommand for migrating third-party      code repos by @imu2008 in (#1335)
    - from version 3.3.16
     * Optimize error messages by @CodeSpaceiiii in (#1327)
     * {Openapi} Return InvalidApiError for unknown API on      restful products by @AllyW in (#1326)
     * feat(acrutil): Add Alibaba Cloud Container Registry(ACR)      Skill management CLI subcommand by @copyrightpoiiiii in (#1329)
     * {Configure} Support BearerToken profile mode by @AllyW in (#1333)
    - from version 3.3.15
     * feat add saectl by @Beimingx in (#1319)
     * Cloud Monitor version 2.0: Independent binary access,      Aliyun CMS2 subcommands by @thinkbetter18 in (#1322)
     * feat(otel): integrate OpenTelemetry support with environment      variable by @CodeSpaceiiii in (#1324)
     * aliyuncms has been renamed to aliyuncms2. COMPAT_MODE, USER_AGENT,      AI_USER_AGENT, and OTEL headers have been added. Issues with business      parameter passing have been fixed by @tingbin-ctb in (#1325)
    - Update to version 3.3.14
     * feat(appmanager): add appmanager subcommand with PyPI+OSS      dual-source by @mengjunwei-mjw in (#1317)
     * {Misc} Add --name and update version check message for plugin      install and adjust agent detection by @AllyW in (#1316)
    - from version 3.3.13
    - Update to version 3.3.12
     * Add AgentBay CLI command and implement language setting logic      by @CodeSpaceiiii in (#1311)
     * {Profile} Add external-account-type for user profile      by @AllyW in (#1312)
     * Implement CLI mock command with add, import, remove, list,      clear, and path subcommands by @CodeSpaceiiii in (#1313)
     * {Openapi} Add agent segment to user-agent by @AllyW in (#1314)
    - from version 3.3.11
     * Fix retrySaveProfile function to return success status and      update tests by @CodeSpaceiiii in (#1310)
    - Update to version 3.3.10
    - from version 3.3.9
     * {Config} Add safety policy env parsing by @AllyW in (#1307)
    - from version 3.3.8
     * {Core} Add plugin install --package and plugin show by @AllyW in (#1301)
    - from version 3.3.7
     * {config} Fix: Only honor ALIBABA_CLOUD_ENDPOINT for profile      endpoint env injection by @AllyW in (#1304)
    - from version 3.3.6
     * {Core} Fix endpoint shorthand flag -e of oss by @AllyW in (#1303)
    - from version 3.3.5
     * feat: profile support endpoint flag by @crimson-gao in (#1298)
     * {Core} Add aliyun upgrade and configurable plugin index source and      fix CloudSSO/OAuth one-off CLI flags persisting by @AllyW in (#1299)
    - Update to version 3.3.4
     * {Core} Fix unknown-flag parsing for plugin-style subcommands      by @AllyW in (#1296)
    - from version 3.3.3
     * {Core} Add ai-mode and safety policy configuration      by @AllyW in (#1295)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow
    vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a
    dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently
    called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer
    arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.
    (CVE-2026-63209)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22117-1 advisory.

    Changes in cadvisor:

    - update to 0.60.6:
      * workflows: mirror release tags to lib/ module tags
      * fs/zfs: fall back to VFS when zfs stats are unavailable
      * storage/stdout: nil-check Cpu, Network, and Memory stats
      * Treat memory-only NUMA nodes as valid topology
    - update vendor.tar to fix
      * bsc#1283657, CVE-2026-63209: cadvisor:
        github.com/klauspost/compress: signed integer overflow in         s2.NewDict()

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22116-1 advisory.

    Changes in hauler:

    - update to 2.1.1:
      * bumped go version to v1.26.7 (backport #771)
      * https registry auth fix (backport #763)
      * adjust supporting artifact retrieval (backport #777)
      * reject --platform on digest-pinned multi-platform images
      * fix: serve registry returns an empty /v2/_catalog list
      * added airgapped support for install.sh and added windows         install.ps1
      * added/fixed basic auth with registry and fileserver
      * fixed store inventory race with concurrent processes
      * added type filter to store copy
      * fixed missing dirs in containers
      * updated github workflows with versions, permissions, and         concurrency

    - update vendor.tar to fix:
      * bsc#1280110, CVE-2026-53495

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4662-1 advisory.

    This update for amazon-cloudwatch-agent fixes the following issue:

    - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an     attacker to bypass       repeat index validation and cause a process crash (bsc#1283594).

    Changes for amazon-cloudwatch-agent:

    Update to version 1.300073.0

     * [Agent] Add Google Cloud support for GCE and GKE by @jefchien      in (#2255), (#2258) and (#2260)
     * [Agent] Add opt-in self-telemetry endpoint for agent metrics      by @movence in (#2246)
     * [ContainerInsights] Add KEDA and Karpenter metrics scraping      by @Paamicky in (#2250)
     * [ContainerInsights] Add watch_replicaset toggle to disable the      ReplicaSet informer by @movence in (#2246)
     * [Metrics/JMX] Format JVM metric units for Tomcat by @Paamicky      in (#2235)
     * [ContainerInsights] Fix EKS OTel Container Insights log delivery      and stabilize cluster-scoped metric identity by @sky333999      in (#2249)
     * [ContainerInsights] Only resolve cluster name when running      in Kubernetes by @Paamicky in (#2259)
     * [Logs] Prevent high log throughput from stalling log collection      while recording file read progress by @lorespiz in (#2253)
    - Update github.com/klauspost/compress to v1.18.7      (bsc#1283594, CVE-2026-63209)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4661-1 advisory.

    This update for google-osconfig-agent fixes the following issue:

    - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an     attacker to bypass       repeat index validation and cause a process crash (bsc#1283672).

    Changes for google-osconfig-agent:

    Update to version 20260928.01

     * scalibr linux new metadata support (#1038)
     * Fix failing to report REBOOTING state during postPatchReboot      due to context canceled for Windows VMs (#1055)
     * Fix os/snap extractor usage (#1053)
    - Update github.com/klauspost/compress to v1.18.7      (bsc#1283672, CVE-2026-63209)
     * bump grpc package to new version (#1057)
     * bump some dependencies across few modules (#1056)
    - Update github.com/klauspost/compress to v1.18.7      (bsc#1283672, CVE-2026-63209)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22039-1 advisory.

    This update for distribution fixes the following issue:

    - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an     attacker to bypass       repeat index validation and cause a process crash (bsc#1283762).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4554-1 advisory.

    This update for google-osconfig-agent fixes the following issue:

    - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an     attacker to bypass       repeat index validation and cause a process crash (bsc#1283672).

    Changes for google-osconfig-agent:

    Update to version 20260928.01

     * scalibr linux new metadata support (#1038)
     * Fix failing to report REBOOTING state during postPatchReboot      due to context canceled for Windows VMs (#1055)
     * Fix os/snap extractor usage (#1053)
    - Update github.com/klauspost/compress to v1.18.7      (bsc#1283672, CVE-2026-63209)
     * bump grpc package to new version (#1057)
     * bump some dependencies across few modules (#1056)
    - Update github.com/klauspost/compress to v1.18.7      (bsc#1283672, CVE-2026-63209)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow     vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a     dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently     called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer     arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.
    (CVE-2026-63209)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
376961	SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2026:5119-1)	Nessus	SuSE Local Security Checks	Local	medium
376249	openSUSE 16 Security Update : rqlite (openSUSE-SU-2026:22224-1)	Nessus	SuSE Local Security Checks	Local	high
376248	openSUSE 16: crane / crane-bash-completion / crane-fish-completion / etc (openSUSE-SU-2026:22227-1)	Nessus	SuSE Local Security Checks	Local	high
371086	SUSE SLES16 Security Update : aliyun-cli (SUSE-SU-2026:24261-1)	Nessus	SuSE Local Security Checks	Local	high
370417	openSUSE 16 Security Update : gh (openSUSE-SU-2026:22134-1)	Nessus	SuSE Local Security Checks	Local	high
370414	openSUSE 16 Security Update : aliyun-cli (openSUSE-SU-2026:22140-1)	Nessus	SuSE Local Security Checks	Local	high
476354	SCA: security update for github.com/klauspost/compress (GHSA-259r-337f-4rfw)	Tenable Cloud Security	SCA Checks	Local	high
476354	SCA: security update for github.com/klauspost/compress (GHSA-259r-337f-4rfw)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
367243	openSUSE 16 Security Update : cadvisor (openSUSE-SU-2026:22117-1)	Nessus	SuSE Local Security Checks	Local	high
367237	openSUSE 16 Security Update : hauler (openSUSE-SU-2026:22116-1)	Nessus	SuSE Local Security Checks	Local	medium
366070	SUSE SLES15 Security Update : amazon-cloudwatch-agent (SUSE-SU-2026:4662-1)	Nessus	SuSE Local Security Checks	Local	high
366058	SUSE SLES15 Security Update : google-osconfig-agent (SUSE-SU-2026:4661-1)	Nessus	SuSE Local Security Checks	Local	high
364342	openSUSE 16 Security Update : distribution (openSUSE-SU-2026:22039-1)	Nessus	SuSE Local Security Checks	Local	high
364128	SUSE SLES12 Security Update : google-osconfig-agent (SUSE-SU-2026:4554-1)	Nessus	SuSE Local Security Checks	Local	high
358378	Linux Distros Unpatched Vulnerability : CVE-2026-63209	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-63209

high

Tenable Plugins

Coming Soon

medium

high

high

high

high

high

high

high

high

medium

high

high

high

high

high