Detections
Analytics

SUSE SLES15 Security Update : golang-github-prometheus-prometheus (SUSE-SU-2026:4606-1)

high Nessus Plugin ID 369278

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4606-1 advisory.

 golang-github-prometheus-prometheus was updated to version 3.13.2:

 - Security issues:

 * CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling (bsc#1266608)
 * CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling (bsc#1272102)
 * CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements (bsc#1275205)
 * CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS (bsc#1269966)
 * CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)
 * CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects (bsc#1275206)
 * CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects (bsc#1275207)
 * CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage (bsc#1270711)
 * CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router (bsc#1267528)
 * CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)
 * CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router (bsc#1267534)
 * CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274221)
 * Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency
 * Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit

 - Bug fixes and changes:

 * Fixed scrape manager failing to reload properly when SD configuration changes rapidly.
 * Prevent memory leak in remote-write path when the receiving endpoint is unavailable.
 * Native Histograms are no longer experimental. They are fully supported for production workloads.
 * Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.
 * TSDB compaction speed optimized by improving the block merging algorithm.
 * Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.
 * Added new metrics to monitor the health of the rule evaluation engine.
 * Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need adjustments to avoid redirects.
 * Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must adapt to the new longer token format.
 * Added 'group_limit' parameter to PromQL aggregations to restrict the number of results.
 * Incompatible: promtool relative paths in config files now resolve relative to the config directory itself, instead of the current working directory.
 * Support exporting TSDB blocks directly to cloud storage via the admin API.
 * Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed in favor of prometheus_wal_watcher_records_read_total.
 * Significant query performance boost for high-cardinality regex matchers.
 * Introduce a new UI interface for safely deleting specific time series data directly.
 * Added dynamic relabeling actions to extract substrings using regex capture groups.
 * Fixed UI displaying incorrect time ranges after a timezone change.
 * Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected golang-github-prometheus-prometheus package.

See Also

https://bugzilla.suse.com/1266608

https://bugzilla.suse.com/1267528

https://bugzilla.suse.com/1267534

https://bugzilla.suse.com/1267538

https://bugzilla.suse.com/1269856

https://bugzilla.suse.com/1269966

https://bugzilla.suse.com/1270711

https://bugzilla.suse.com/1272102

https://bugzilla.suse.com/1274221

https://bugzilla.suse.com/1275205

https://bugzilla.suse.com/1275206

https://bugzilla.suse.com/1275207

https://www.suse.com/security/cve/CVE-2023-45289

https://www.suse.com/security/cve/CVE-2025-4673

https://www.suse.com/security/cve/CVE-2025-61686

https://www.suse.com/security/cve/CVE-2026-2303

https://www.suse.com/security/cve/CVE-2026-39821

https://www.suse.com/security/cve/CVE-2026-40181

https://www.suse.com/security/cve/CVE-2026-42211

https://www.suse.com/security/cve/CVE-2026-42342

https://www.suse.com/security/cve/CVE-2026-44990

https://www.suse.com/security/cve/CVE-2026-53606

https://www.suse.com/security/cve/CVE-2026-56852

http://www.nessus.org/u?5b592f45

Plugin Details

Severity: High

ID: 369278

File Name: suse_SU-2026-4606-1.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 10/21/2026

Updated: 10/21/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.5

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2026-40181

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/o:novell:suse_linux:15, p-cpe:/a:novell:suse_linux:golang-github-prometheus-prometheus

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/9/2026

Vulnerability Publication Date: 2/29/2024

Reference Information

CVE: CVE-2023-45289, CVE-2025-4673, CVE-2025-61686, CVE-2026-2303, CVE-2026-39821, CVE-2026-40181, CVE-2026-42211, CVE-2026-42342, CVE-2026-44990, CVE-2026-53606, CVE-2026-56852

SuSE: SUSE-SU-2026:4606-1