Detections
Analytics
EulerOS 2.0 SP12 : golang (EulerOS-SA-2026-3339)
medium Nessus Plugin ID 343608
Synopsis
The remote EulerOS host is missing multiple security updates.Description
According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.(CVE-2026-42499)
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.(CVE-2026-33814)
If a trusted template author were to write a script tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the script block.(CVE-2026-39826)
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.(CVE-2025-61732)
The 'go bug' command writes to two files with predictable names in the system temporary directory (for example, '/tmp'). An attacker with access to the temporary directory can create a symlink in one of these names, causing 'go bug' to overwrite the target of the symlink.(CVE-2026-39819)
CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a meta tag's content attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the content attribute, the escaper would fail to similarly escape it, leading to XSS.(CVE-2026-39823)
Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.(CVE-2026-39820)
Tenable has extracted the preceding description block directly from the EulerOS golang security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected golang packages.See Also
Plugin Details
Severity: Medium
ID: 343608
File Name: EulerOS_SA-2026-3339.nasl
Version: 1.1
Type: Local
Family: Huawei Local Security Checks
Published: 9/8/2026
Updated: 9/8/2026
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.3
Percentile: 53.6
CVSS v2
Risk Factor: Medium
Base Score: 4.5
Temporal Score: 3.3
Vector: CVSS2#AV:L/AC:H/Au:S/C:P/I:C/A:N
CVSS Score Source: CVE-2026-39819
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Temporal Score: 4.6
Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:huawei:euleros:2.0, p-cpe:/a:huawei:euleros:golang-devel, p-cpe:/a:huawei:euleros:golang-help, p-cpe:/a:huawei:euleros:golang
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/EulerOS/release, Host/EulerOS/rpm-list, Host/EulerOS/sp
Excluded KB Items: Host/EulerOS/uvp_version
Exploit Ease: No known exploits are available
Patch Publication Date: 9/8/2026
Vulnerability Publication Date: 2/5/2026
Reference Information
CVE: CVE-2025-61732, CVE-2026-33814, CVE-2026-39819, CVE-2026-39820, CVE-2026-39823, CVE-2026-39826, CVE-2026-42499