An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range. To remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22321-1 advisory.

    Changes in rqlite:

    - Update to version 10.6.6:
      * Keep the local auto-backup file if the metadata rename fails
      * Reject local auto-backup filenames reserved for internal use
      * POST /demote and POST /promote return a JSON error body, and         404 when the target node is not in the cluster.
      * DELETE /remove returns a JSON error body.
    - Includes changes from  version 10.6.5:
      * Guard the inter-node backup stream handler directly against a         missing backup request
      * POST /leader returns a JSON error body, and 404 when the target         node is not in the cluster

    - Update to version 10.6.4:
      * BACKUP_STREAM authorization failures can disclose the database         and crash rqlited (boo#1286934)
      * GET /leader returns a JSON error body when there is no leader
      * Close the connection after rejecting an unauthorized inter-node         backup stream request, instead of streaming the database anyway
      * Decide inter-node command authorization once, before dispatch,         and close the connection after rejecting any unauthorized         command

    - Update to version 10.6.3:
      * Node probes honor request context and commit exactly one         result
      * Make DB connections a first-class object
      * Prevent ATTACH on the query database connection

    - Update to version 10.6.2:
      * Check for trailing junk in request bodies
      * Console schema view handles table names that collide with         JavaScript object properties
      * Set CommitTimestamps in CDC Events Group
      * Upgrade dependencies

    - Update to version 10.6.1:
      * Use constant-time comparison when comparing passwords
      * Conditionally rewrite SQL during queued writes and fix         rewriting of CURRENT_TIMESTAMP and related tokens
      * More robust Leader stepdown node ID detection, reap checks,         and SQL analyze start-time recording
      * CDC fixes: encode non-finite floats, always release flush         waiters, and make the HTTP sink follow redirects
      * Converted _service from mode=disabled to mode=manual (legacy         leftover; services are run by hand via osc service manualrun)
      * Package is not affected by CVE-2026-84445 (boo#1278793),         CVE-2026-84304 (boo#1279102), CVE-2026-84303 (boo#1279253):
        vendored grpc is v1.84.0, above the v1.83.1/v1.83.2 fixes
      * Package is not affected by CVE-2026-89090 (boo#1280657):
        vendored eventstream is v1.7.20, above the v1.7.8 fix
      * Package is not affected by CVE-2026-63209 (boo#1283555):
        vendored klauspost/compress is v1.20.1, above the v1.18.7         fix
      * Package is not affected by CVE-2026-39821 (boo#1266544):
        vendored golang.org/x/net is v0.59.0, above the v0.55.0         fix

    - Update to version 10.6.0:
      * API addition: error_v2 may contain numeric SQLite error codes.
      * addresses a security issue related to Authentication files. A         user with no explicit permissions could be grant elevated         permissions. Correctly configured users do not suffer from this         issue.
      * multiple implementation changes and bug fixes
      * Display interactive cluster topology on web console.
      * Support configurable queued-writes retries
      * release addresses a gap in the role-based access permissions         related to change-data-capture (CDC) handling

    - Update to version 10.3.6:
      * Add query logging to database layer
      * Snapshot IDs now contain (optional) generation
      * Bump generation ID if snapshot IDs collide
      * Snapshots can be filtered by term and index
      * Add support for File Renaming and Removing with retries
      * Replace standard library with fsutil
      * Keep snapshot ordering correct regardless of clock
      * Remove snapshot name generation ID

    - Update to version 10.3.5:
      * Reject alternate form of unsupported PRAGMA commands
      * Handle negative trailing logs
      * Sync access to last backup time at http layer
      * Set the Served by header before first backup byte
      * Set DB load response time for all formats
      * Fix HTTP logic error for queued statements
      * Minor web console fixes
    - includes changes from 10.0.4:
      * Do not emit rolled-back events over CDC
    - includes changes from 10.0.3:
      * Refactor busy timeout methods
      * Fix edge-case bugs detected by GPT-6 Astra
      * Switch to quay.io/minio/minio:latest for testing purposes
      * Fix removing a node with different ID, but same Raft address
      * Use correct Foreign Key setting when recovering node
      * Only dump the indexes and triggers of the selected tables
      * Detect DB changes during Request(RETURNING)
      * Snapshot Open() first checks for failed reap
      * Sync snapshot plan directory
      * Propagate WAL stat errors
      * Clean up cancelled snapshots
      * Reject incomplete snapshot headers
      * Validate restore database header
      * Only reap a sole fullsnapshot if it has zero WALs
      * Keep database dumps consistent during writes to the database
      * Roll back DB Requests on statement-prepare errors
    - includes changes from 10.0.2:
      * Upgrade SQLite driver
      * Unit test reaping an installed Snapshot and streamed Snapshot combo
      * Use distinct Snapshot Namer type
      * Replace breaking-pragma regexes with ASCII prefix scanning
      * Consolidate pragma and txStatus reads onto a single connection per pool
      * Fix some magic strings in db package

    - Update to version 10.3.1:
      * Consolidate SQLite driver construction
      * Plumb Term and Index through during Snapshot Restore
      * Hard exit if FSM Restore fails post database-swap

    - Update to version 10.3.0:
      * Console app supports quickly querying for first 100 rows of a         table
      * Rename read-only nodes to read replicas. Command-line flags         unchanged
      * Bundles dependencies updated
      * Add infra for pushing OTLP metrics to an OpenTelemetry         Collector
      * Add query logging at database level
      * Add CopyDir functionality to file utils.
      * Add ability to clone Snapshots, primarily for testing purposes
      * Store Index and Term in Fingerprint file and check during         start-up

    - Update to version 10.2.7:
      * Remove explicit database-level read-only check from the pure         Query path
      * Miscellaneous Store-level fixes related to resource management         and shutdown sequence
      * Don't run CRC checks twice on Snapshot when fast-restart is         explicitly disabled
      * Fixes to the http package including SQL rewriting control.
      * Address potential dropped CDC event on restart
      * Various minor fixes
    - includes changes from 10.2.6:
      * Handle a fully-executed Reap plan, but Plan file itself not         removed
      * Close Snapshot streamer on error.
    - includes changes from 10.2.5:
      * Perform a Quick Integrity check after reaping snapshots, not         Full

    - Update to version 10.2.4:
      * Fix some non-AWS S3-compatible stores
    - includes changes from 10.2.3
      * Check snapshot store integrity before first actual use
      * Disable HTTP timeout for boot and restore operations via the shell
      * HTTP layer ignores ErrNoWALToSnapshot when snapshotting
      * Close Snapshot Streamer ASAP when restoring to local node

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-95362fedd2 advisory.

    Update to 0.34.2

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-9028005172 advisory.

    Update to 0.34.2

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22224-1 advisory.

    Changes in rqlite:

    - Update to version 10.6.6:
      * Keep the local auto-backup file if the metadata rename fails
      * Reject local auto-backup filenames reserved for internal use
      * POST /demote and POST /promote return a JSON error body, and         404 when the target node is not in the cluster.
      * DELETE /remove returns a JSON error body.
    - Includes changes from  version 10.6.5:
      * Guard the inter-node backup stream handler directly against a         missing backup request
      * POST /leader returns a JSON error body, and 404 when the target         node is not in the cluster

    - Update to version 10.6.4:
      * BACKUP_STREAM authorization failures can disclose the database         and crash rqlited (boo#1286934)
      * GET /leader returns a JSON error body when there is no leader
      * Close the connection after rejecting an unauthorized inter-node         backup stream request, instead of streaming the database anyway
      * Decide inter-node command authorization once, before dispatch,         and close the connection after rejecting any unauthorized         command

    - Update to version 10.6.3:
      * Node probes honor request context and commit exactly one         result
      * Make DB connections a first-class object
      * Prevent ATTACH on the query database connection

    - Update to version 10.6.2:
      * Check for trailing junk in request bodies
      * Console schema view handles table names that collide with         JavaScript object properties
      * Set CommitTimestamps in CDC Events Group
      * Upgrade dependencies

    - Update to version 10.6.1:
      * Use constant-time comparison when comparing passwords
      * Conditionally rewrite SQL during queued writes and fix         rewriting of CURRENT_TIMESTAMP and related tokens
      * More robust Leader stepdown node ID detection, reap checks,         and SQL analyze start-time recording
      * CDC fixes: encode non-finite floats, always release flush         waiters, and make the HTTP sink follow redirects
      * Converted _service from mode=disabled to mode=manual (legacy         leftover; services are run by hand via osc service manualrun)
      * Package is not affected by CVE-2026-84445 (boo#1278793),         CVE-2026-84304 (boo#1279102), CVE-2026-84303 (boo#1279253):
        vendored grpc is v1.84.0, above the v1.83.1/v1.83.2 fixes
      * Package is not affected by CVE-2026-89090 (boo#1280657):
        vendored eventstream is v1.7.20, above the v1.7.8 fix
      * Package is not affected by CVE-2026-63209 (boo#1283555):
        vendored klauspost/compress is v1.20.1, above the v1.18.7         fix
      * Package is not affected by CVE-2026-39821 (boo#1266544):
        vendored golang.org/x/net is v0.59.0, above the v0.55.0         fix

    - Update to version 10.6.0:
      * API addition: error_v2 may contain numeric SQLite error codes.
      * addresses a security issue related to Authentication files. A         user with no explicit permissions could be grant elevated         permissions. Correctly configured users do not suffer from this         issue.
      * multiple implementation changes and bug fixes
      * Display interactive cluster topology on web console.
      * Support configurable queued-writes retries
      * release addresses a gap in the role-based access permissions         related to change-data-capture (CDC) handling

    - Update to version 10.3.6:
      * Add query logging to database layer
      * Snapshot IDs now contain (optional) generation
      * Bump generation ID if snapshot IDs collide
      * Snapshots can be filtered by term and index
      * Add support for File Renaming and Removing with retries
      * Replace standard library with fsutil
      * Keep snapshot ordering correct regardless of clock
      * Remove snapshot name generation ID

    - Update to version 10.3.5:
      * Reject alternate form of unsupported PRAGMA commands
      * Handle negative trailing logs
      * Sync access to last backup time at http layer
      * Set the Served by header before first backup byte
      * Set DB load response time for all formats
      * Fix HTTP logic error for queued statements
      * Minor web console fixes
    - includes changes from 10.0.4:
      * Do not emit rolled-back events over CDC
    - includes changes from 10.0.3:
      * Refactor busy timeout methods
      * Fix edge-case bugs detected by GPT-6 Astra
      * Switch to quay.io/minio/minio:latest for testing purposes
      * Fix removing a node with different ID, but same Raft address
      * Use correct Foreign Key setting when recovering node
      * Only dump the indexes and triggers of the selected tables
      * Detect DB changes during Request(RETURNING)
      * Snapshot Open() first checks for failed reap
      * Sync snapshot plan directory
      * Propagate WAL stat errors
      * Clean up cancelled snapshots
      * Reject incomplete snapshot headers
      * Validate restore database header
      * Only reap a sole fullsnapshot if it has zero WALs
      * Keep database dumps consistent during writes to the database
      * Roll back DB Requests on statement-prepare errors
    - includes changes from 10.0.2:
      * Upgrade SQLite driver
      * Unit test reaping an installed Snapshot and streamed Snapshot combo
      * Use distinct Snapshot Namer type
      * Replace breaking-pragma regexes with ASCII prefix scanning
      * Consolidate pragma and txStatus reads onto a single connection per pool
      * Fix some magic strings in db package

    - Update to version 10.3.1:
      * Consolidate SQLite driver construction
      * Plumb Term and Index through during Snapshot Restore
      * Hard exit if FSM Restore fails post database-swap

    - Update to version 10.3.0:
      * Console app supports quickly querying for first 100 rows of a         table
      * Rename read-only nodes to read replicas. Command-line flags         unchanged
      * Bundles dependencies updated
      * Add infra for pushing OTLP metrics to an OpenTelemetry         Collector
      * Add query logging at database level
      * Add CopyDir functionality to file utils.
      * Add ability to clone Snapshots, primarily for testing purposes
      * Store Index and Term in Fingerprint file and check during         start-up

    - Update to version 10.2.7:
      * Remove explicit database-level read-only check from the pure         Query path
      * Miscellaneous Store-level fixes related to resource management         and shutdown sequence
      * Don't run CRC checks twice on Snapshot when fast-restart is         explicitly disabled
      * Fixes to the http package including SQL rewriting control.
      * Address potential dropped CDC event on restart
      * Various minor fixes
     - includes changes from 10.2.6:
      * Handle a fully-executed Reap plan, but Plan file itself not         removed
      * Close Snapshot streamer on error.
    - includes changes from 10.2.5:
      * Perform a Quick Integrity check after reaping snapshots, not         Full

    - Update to version 10.2.4:
      * Fix some non-AWS S3-compatible stores
    - includes changes from 10.2.3
      * Check snapshot store integrity before first actual use
      * Disable HTTP timeout for boot and restore operations via the shell
      * HTTP layer ignores ErrNoWALToSnapshot when snapshotting
      * Close Snapshot Streamer ASAP when restoring to local node

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7aab7a2bbe advisory.

    Update to 1.75.2

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3ed4522172 advisory.

    Update to 2.73.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3360 advisory.

    Due to security concerns regarding a small set of intermediate certificates issued by a specific     Certificate Authority (CA), the Go's crypto/x509 package is updated to not trust certificates issued by     the affected intermediate certificates. This would prevent possible future misuse of certificate issued by     the affected intermediate certificates.

    Amazon Linux golang-based packages are being rebuilt with the fixed crypto/x509 package described in     CVE-2026-111943 as a defense-in-depth measure against the eMudhra intermediate CA certificates with weak     private keys.

    By default, Go programs on Amazon Linux use the system-wide certificate authority (CA) store. Therefore,     the primary fix for this issue is the ca-certificates update that removes the root CA certificates that     signed the affected intermediates. Customers should ensure that update is installed:
    https://explore.alas.aws.amazon.com/CVE-2026-113470.html (CVE-2026-111943)

    An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before     release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application     process via a crafted event stream response frame containing a header value type outside the valid range.



    To remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or     derivative code. (CVE-2026-89090)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22145-1 advisory.

    - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in     gRPC-Go xDS       servers (bsc#1279042).
    - CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response     frames       containing a crafted header value type byte outside the valid range can cause the host process to     terminate       (bsc#1280679).

    Changes for amazon-ecs-init:

    - Update to version 1.108.0
     * Enhancement - Add ECS-Init install pointer for non-Amazon Linux      AMIs to README (#5161)
     * Enhancement - Remove direct docker run instructions from README (#5160)
     * Enhancement - Bump github.com/aws/aws-sdk-go-v2/config from 1.28.1      to 1.33.6 in /ecs-agent, /agent, and /ecs-init (#5159)
     * Feature - Enable IMDS IAM roles config resolution (#5154)
     * Enhancement - Bump github.com/containerd/containerd from 1.7.33      to 1.7.36 in /agent (#5155)
     * Enhancement - Bump github.com/containerd/containerd from 1.7.35      to 1.7.36 in /ecs-init (#5156)
     * Enhancement - Bump github.com/aws/aws-sdk-go-v2/service/ec2 from      1.195.0 to 1.334.0 in /ecs-agent and /agent (#5148)
     * Enhancement - Bump google.golang.org/grpc from 1.83.1 to 1.83.2      in /ecs-agent, /ecs-agent/daemonimages/csidriver and /agent (#5153)      (bsc#1279042, CVE-2026-84445)
     * Enhancement - Bump go.opentelemetry.io/otel/exporters/otlp/      otlptrace/otlptracehttp from 1.43.0 to 1.45.0 in /agent (#5141)
     * Enhancement - IMDS credential scanner/refresher updates (#5145)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:24265-1 advisory.

    - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in     gRPC-Go xDS       servers (bsc#1279042).
    - CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response     frames       containing a crafted header value type byte outside the valid range can cause the host process to     terminate       (bsc#1280679).

    Changes for amazon-ecs-init:

    - Update to version 1.108.0
     * Enhancement - Add ECS-Init install pointer for non-Amazon Linux      AMIs to README (#5161)
     * Enhancement - Remove direct docker run instructions from README (#5160)
     * Enhancement - Bump github.com/aws/aws-sdk-go-v2/config from 1.28.1      to 1.33.6 in /ecs-agent, /agent, and /ecs-init (#5159)
     * Feature - Enable IMDS IAM roles config resolution (#5154)
     * Enhancement - Bump github.com/containerd/containerd from 1.7.33      to 1.7.36 in /agent (#5155)
     * Enhancement - Bump github.com/containerd/containerd from 1.7.35      to 1.7.36 in /ecs-init (#5156)
     * Enhancement - Bump github.com/aws/aws-sdk-go-v2/service/ec2 from      1.195.0 to 1.334.0 in /ecs-agent and /agent (#5148)
     * Enhancement - Bump google.golang.org/grpc from 1.83.1 to 1.83.2      in /ecs-agent, /ecs-agent/daemonimages/csidriver and /agent (#5153)      (bsc#1279042, CVE-2026-84445)
     * Enhancement - Bump go.opentelemetry.io/otel/exporters/otlp/      otlptrace/otlptracehttp from 1.43.0 to 1.45.0 in /agent (#5141)
     * Enhancement - IMDS credential scanner/refresher updates (#5145)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8ba9889b7c advisory.

    Update to 2.73.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22032-1 advisory.

    - CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error     Handling       (bsc#1269861).
    - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method     of a POST       request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing     allows for DoS       via oversized inputs (bsc#1276742).
    - CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can     lead to       exfiltration of sensitive data (bsc#1267482).
    - CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause     a DoS       (bsc#1267483).
    - CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and     can cause OBI       out-of-bounds reads to leak memory into telemetry (bsc#1267484).
    - CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel     memory and cause       that memory to be copied into telemetry (bsc#1267486).
    - CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled `writev` buffers and allows multi-     segment calls to       read and overwrite memory beyond the first segment (bsc#1267487).
    - CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the     size of a       parameter value overflows the message buffer (bsc#1272418).
    - CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the     ebpf-profiler       agent (bsc#1268982).
    - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input     (bsc#1272028).
    - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and     deadlocks in the       crypto/ssh library (bsc#1278671).
    - CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution     (bsc#1276982).
    - CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the     reference storage       (bsc#1276992).
    - CVE-2026-75889: arbitrary file reads due to the `prometheus.operator.servicemonitors` component allowing     users who can       modify `ServiceMonitor` resources in a watched namespace to specify an arbitrary local file through     `bearerTokenFile`       (bsc#1277429).
    - CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated     database name in       Client.BulkWrite (bsc#1278693).
    - CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response     frames       containing a crafted header value type byte outside the valid range can cause the host process to     terminate       (bsc#1280671).

    Changes for alloy:

    Update to version 1.19.2:

     * Remove withdrawn lib/pq CVEs from govulncheck
     * Add backticks to component name in generated doc output
     * BREAKING CHANGE: prometheus.operator.servicemonitors now      rejects endpoints that reference local files by default. Set      allow_arbitrary_file_access = true to preserve previous      behavior.
     * prometheus.enrich: Support multi-label matching
     * prometheus.relabel: Add opt-in TTL cache mode
     * telemetry: Add new metrics for graph connections and      pyroscope forwarded entries
     * database_observability: Exclude system schemas from MySQL      health checks and redact query text in explain_plans
     * Add nop receiver to OTel Engine
     * Backport dependency upgrades to address GO-2026-6061

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1e56ab167d advisory.

    Update to 3.15.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0ed67903d8 advisory.

    Update to 3.15.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4408-1 advisory.

    - CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error     Handling       (bsc#1269861).
    - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method     of a POST       request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing     allows for DoS       via oversized inputs (bsc#1276742).
    - CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can     lead to       exfiltration of sensitive data (bsc#1267482).
    - CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause     a DoS       (bsc#1267483).
    - CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and     can cause OBI       out-of-bounds reads to leak memory into telemetry (bsc#1267484).
    - CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel     memory and cause       that memory to be copied into telemetry (bsc#1267486).
    - CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled `writev` buffers and allows multi-     segment calls to       read and overwrite memory beyond the first segment (bsc#1267487).
    - CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the     size of a       parameter value overflows the message buffer (bsc#1272418).
    - CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the     ebpf-profiler       agent (bsc#1268982).
    - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input     (bsc#1272028).
    - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and     deadlocks in the       crypto/ssh library (bsc#1278671).
    - CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution     (bsc#1276982).
    - CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the     reference storage       (bsc#1276992).
    - CVE-2026-75889: arbitrary file reads due to the `prometheus.operator.servicemonitors` component allowing     users who can       modify `ServiceMonitor` resources in a watched namespace to specify an arbitrary local file through     `bearerTokenFile`       (bsc#1277429).
    - CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated     database name in       Client.BulkWrite (bsc#1278693).
    - CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response     frames       containing a crafted header value type byte outside the valid range can cause the host process to     terminate       (bsc#1280671).

    Changes for alloy:

    - Update to version 1.19.2.
    - Update to version 1.19.1.
    - Update to version 1.19.0:
     * BREAKING CHANGE: prometheus.operator.servicemonitors now      rejects endpoints that reference local files by default. Set      allow_arbitrary_file_access = true to preserve previous      behavior.
     * prometheus.enrich: Support multi-label matching
     * prometheus.relabel: Add opt-in TTL cache mode
     * telemetry: Add new metrics for graph connections and      pyroscope forwarded entries
     * database_observability: Exclude system schemas from MySQL      health checks and redact query text in explain_plans
    - Update to version 1.18.1:
     * Add nop receiver to OTel Engine

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21925-1 advisory.

    Changes in keybase-client:

    - CVE-2026-89090: Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-9eaee019b6 advisory.

    Update to 5.5.1

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-578a96e5f5 advisory.

    Update to 5.5.1

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before     release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application     process via a crafted event stream response frame containing a header value type outside the valid range.
    To remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or     derivative code. (CVE-2026-89090)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1906 advisory.

    Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder

    An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before     release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application     process via a crafted event stream response frame containing a header value type outside the valid range.



    To remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or     derivative code. (CVE-2026-89090)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
381197	openSUSE 16 Security Update : rqlite (openSUSE-SU-2026:22321-1)	Nessus	SuSE Local Security Checks	Local	high
378687	Fedora 44 : alertmanager (2026-95362fedd2)	Nessus	Fedora Local Security Checks	Local	high
378675	Fedora 45 : alertmanager (2026-9028005172)	Nessus	Fedora Local Security Checks	Local	high
376249	openSUSE 16 Security Update : rqlite (openSUSE-SU-2026:22224-1)	Nessus	SuSE Local Security Checks	Local	high
374678	Fedora 45 : rclone (2026-7aab7a2bbe)	Nessus	Fedora Local Security Checks	Local	critical
374676	Fedora 45 : chezmoi (2026-3ed4522172)	Nessus	Fedora Local Security Checks	Local	high
374389	Amazon Linux 2023 : credentials-fetcher (ALAS2023-2026-3360)	Nessus	Amazon Linux Local Security Checks	Local	high
371101	openSUSE 16 Security Update : amazon-ecs-init (openSUSE-SU-2026:22145-1)	Nessus	SuSE Local Security Checks	Local	high
371097	SUSE SLES16 Security Update : amazon-ecs-init (SUSE-SU-2026:24265-1)	Nessus	SuSE Local Security Checks	Local	high
366735	Fedora 44 : chezmoi (2026-8ba9889b7c)	Nessus	Fedora Local Security Checks	Local	high
364343	openSUSE 16 Security Update : alloy (openSUSE-SU-2026:22032-1)	Nessus	SuSE Local Security Checks	Local	high
362883	Fedora 44 : prometheus (2026-1e56ab167d)	Nessus	Fedora Local Security Checks	Local	high
362819	Fedora 45 : prometheus (2026-0ed67903d8)	Nessus	Fedora Local Security Checks	Local	high
362571	SUSE SLED15 / SLES15 Security Update : alloy (SUSE-SU-2026:4408-1)	Nessus	SuSE Local Security Checks	Local	high
350165	openSUSE 16 Security Update : keybase-client (openSUSE-SU-2026:21925-1)	Nessus	SuSE Local Security Checks	Local	high
349777	Fedora 45 : lego (2026-9eaee019b6)	Nessus	Fedora Local Security Checks	Local	high
349767	Fedora 44 : lego (2026-578a96e5f5)	Nessus	Fedora Local Security Checks	Local	high
345676	Linux Distros Unpatched Vulnerability : CVE-2026-89090	Nessus	Misc.	Local	high
323719	Amazon Linux 2023 : ecs-init (ALAS2023-2026-1906)	Nessus	Amazon Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2026-89090

high

Tenable Plugins

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high