It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1875 advisory.

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject     Alternative Name (SAN) entries. This caused strings.Split(host, .) to execute repeatedly on the same     input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of     SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before     building the certificate chain, this overhead occurred even for untrusted certificates. (CVE-2026-27145)

    Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive     CPU. (CVE-2026-42504)

    When returning errors, functions in the net/textproto package would include its input as part of the     error. This might allow an attacker to inject misleading content to errors that are printed or logged.
    (CVE-2026-42507)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2023 : compat-golang-github-cpuguy83-md2man-2-devel, golang-github-cpuguy83-md2man, golang-github-cpuguy83-md2man-devel (ALAS2023-2026-1875)

medium Nessus Plugin ID 322040

Version 1.2