The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22158-1 advisory.

    Security issues fixed:

    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265782).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266625).
    - CVE-2026-39984: github.com/sigstore/timestamp-authority/v2/pkg/verification: improper certificate     validation can be       used to bypass some authorization controls (bsc#1262346).
    - CVE-2026-41567: arbitrary code execution with full daemon privileges when a user uploads a compressed     archive into       that container (bsc#1267827).

    Non security issue fixed:

    - SELinux CIL files are not shipped in Docker (bsc#1278193).

    Changes for docker:

    - Update to Docker 29.7.2. See upstream changelog online at      <https://docs.docker.com/engine/release-notes/29/#2972>      fixes(bsc#1268280, bsc#1268359, bsc#1271209, bsc#1266176)
    - Update to buildx 0.36.1. See upstream changelog online at      <https://github.com/docker/buildx/releases/tag/v0.36.1>

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

openSUSE 16: docker / docker-bash-completion / docker-buildx / etc (openSUSE-SU-2026:22158-1)

high Nessus Plugin ID 371819

Version 1.2