Detections
Analytics

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : Go vulnerabilities (USN-8935-1)

critical Nessus Plugin ID 367749

Language:

Synopsis

The remote Ubuntu host is missing one or more security updates.

Description

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8935-1 advisory.

 It was discovered that Go did not enforce a maximum recursion depth when parsing deeply nested ASN.1 structures. An attacker could possibly use this issue to cause Go to crash, resulting in a denial of service. (CVE-2026-33818)

 It was discovered that Go incorrectly reset the depth counter when decoding XML elements. An attacker could possibly use this issue to cause Go to crash via deeply nested XML input, resulting in a denial of service. (CVE-2026-56859)

 It was discovered that Go incorrectly handled TLS KeyUpdate messages after the handshake was completed. A remote attacker could possibly use this issue to cause Go to use excessive resources, leading to a denial of service. (CVE-2026-56862)

 It was discovered that Go did not correctly verify checksum database tiles against their parents. An attacker in control of a malicious module proxy could possibly use this issue to bypass checksum database verification and serve malicious module content. (CVE-2026-56865)

 It was discovered that the Go HTTP client incorrectly returned connections to the idle pool after a rejected HTTP/1 CONNECT request with a request body. A remote attacker could possibly use this issue to perform HTTP response poisoning attacks against reverse proxies. (CVE-2026-56866)

 It was discovered that the Go HTTP/2 server did not apply header limits to Trailer headers. A remote attacker could possibly use this issue to cause Go to use excessive resources, leading to a denial of service. (CVE-2026-78659)

 It was discovered that the Go HTTP/2 implementation did not remove malformed framing-related headers when forwarding responses. A remote attacker could possibly use this issue to perform HTTP response smuggling attacks when Go was acting as a reverse proxy. (CVE-2026-78660)

 It was discovered that the Go HTTP/2 server could refund connection-level flow control twice for the same data under certain circumstances. A remote attacker could possibly use this issue to bypass the configured connection-level flow control limit. (CVE-2026-78663)

 It was discovered that Go did not limit the size of Range headers parsed when serving content over HTTP. A remote attacker could possibly use this issue to cause Go to use excessive resources, leading to a denial of service. (CVE-2026-78667)

 It was discovered that the Go HTTP/2 implementation incorrectly handled SETTINGS frames that changed the initial window size. A remote attacker could possibly use this issue to cause Go to use excessive resources, leading to a denial of service. (CVE-2026-78669)

 It was discovered that the Go HTTP server continued to serve requests on a connection after sending a successful response to an HTTP/1 CONNECT request. A remote attacker could possibly use this issue to perform HTTP request smuggling attacks. (CVE-2026-94439)

 It was discovered that Go did not enforce memory limits on the first line of a part when parsing multipart forms. A remote attacker could possibly use this issue to cause Go to use excessive resources, leading to a denial of service. (CVE-2026-94440)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected golang-1.22, golang-1.22-go and / or golang-1.22-src packages.

See Also

https://ubuntu.com/security/notices/USN-8935-1

Plugin Details

Severity: Critical

ID: 367749

File Name: ubuntu_USN-8935-1.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 10/20/2026

Updated: 10/20/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.46

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:C

CVSS Score Source: CVE-2026-78663

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:canonical:ubuntu_linux:20.04:-:lts, cpe:/o:canonical:ubuntu_linux:22.04:-:lts, cpe:/o:canonical:ubuntu_linux:24.04:-:lts, p-cpe:/a:canonical:ubuntu_linux:golang-1.22-go, p-cpe:/a:canonical:ubuntu_linux:golang-1.22-src, p-cpe:/a:canonical:ubuntu_linux:golang-1.22

Required KB Items: Host/cpu, Host/Debian/dpkg-l, Host/Ubuntu, Host/Ubuntu/release

Exploit Ease: No known exploits are available

Patch Publication Date: 10/19/2026

Vulnerability Publication Date: 8/13/2026

Reference Information

CVE: CVE-2026-33818, CVE-2026-56859, CVE-2026-56862, CVE-2026-56865, CVE-2026-56866, CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78667, CVE-2026-78669, CVE-2026-94439, CVE-2026-94440

USN: 8935-1