Detections
Analytics

openSUSE 16 Security Update : prometheus-blackbox_exporter (openSUSE-SU-2026:22026-1)

high Nessus Plugin ID 364112

Synopsis

The remote openSUSE host is missing one or more security updates.

Description

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22026-1 advisory.

 Changes in prometheus-blackbox_exporter:

 - CVE-2026-84304: Fix heap memory exhaustion (OOM) via HTTP/2 DATA frame fragmentation in gRPC-Go by bumping it to version 1.83.1 (bsc#1279126)

 - CVE-2026-39821: Fix potential validation bypass and privilege escalation by bumping golang.org/x/net to version 0.57.0 (bsc#1266556)

 - CVE-2026-39821: Bump golang.org/x/net to version 0.55.0 (bsc#1266556)

 - Build only for SUSE distributions

 - Upgrade to version 0.26.0 (jsc#PED-12872):
 * Changes:
 Replace go-kit/log with log/slog module.
 * Features:
 Add metric to record tls ciphersuite negotiated during handshake.
 Add a way to export labels with content matched by the probe.
 Reports Certificate Serial number.
 * Enhancement:
 Add stale workflow to start sync with stale.yaml in Prometheus.
 * Bug fixes:
 Only register grpc TLS metrics on successful handshake.

 - Upgrade to version 0.25.0:
 * Features:
 Allow to get Probe logs by target.
 Log errors from probe.
 * Bug fixes:
 Prevent logging confusing error message.
 Explicit registration of internal exporter metrics.

 - Security:
 * CVE-2025-22870: Fix proxy bypassing using IPv6 zone IDs (bsc#1238680)
 * CVE-2023-45288: Fix closing connections when receiving too many headers (bsc#1236515)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected prometheus-blackbox_exporter package.

See Also

https://bugzilla.suse.com/1236515

https://bugzilla.suse.com/1238680

https://bugzilla.suse.com/1266556

https://bugzilla.suse.com/1279126

https://www.suse.com/security/cve/CVE-2023-45288

https://www.suse.com/security/cve/CVE-2025-22870

https://www.suse.com/security/cve/CVE-2026-39821

https://www.suse.com/security/cve/CVE-2026-84304

Plugin Details

Severity: High

ID: 364112

File Name: openSUSE-2026-22026-1.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 10/8/2026

Updated: 10/8/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.39

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2026-39821

CVSS v3

Risk Factor: High

Base Score: 8.2

Temporal Score: 7.4

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 7.7

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-84304

Vulnerability Information

CPE: cpe:/o:novell:opensuse:16.0, p-cpe:/a:novell:opensuse:prometheus-blackbox_exporter

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/6/2026

Vulnerability Publication Date: 4/3/2024

Reference Information

CVE: CVE-2023-45288, CVE-2025-22870, CVE-2026-39821, CVE-2026-84304