The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3755-1 advisory.

    - CVE-2024-24791: Fixed denial of service due to improper 100-continue handling (bsc#1227314)
    - CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip (bsc#1225973)
    - CVE-2024-24790: Fixed unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip     (bsc#1225974)
    - CVE-2024-24787: Fixed arbitrary code execution during build on darwin in cmd/go (bsc#1224017)
    - CVE-2023-45288: Fixed denial of service due to close connections when receiving too many headers in     net/http and x/net/http2 (bsc#1221400)
    - CVE-2023-45289: Fixed incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http     and net/http/cookiejar (bsc#1221000)
    - CVE-2023-45290: Fixed memory exhaustion in Request.ParseMultipartForm in net/http (bsc#1221001)
    - CVE-2024-24783: Fixed denial of service on certificates with an unknown public key algorithm in     crypto/x509 (bsc#1220999)
    - CVE-2024-24784: Fixed comments in display names are incorrectly handled in net/mail (bsc#1221002)
    - CVE-2024-24785: Fixed errors returned from MarshalJSON methods may break template escaping in     html/template (bsc#1221003)

    Other fixes:
    - Update to version 1.21.13.1 cut from the go1.21-fips-release (jsc#SLE-18320)
    - Update to version 1.21.13 (bsc#1212475)
    - Remove subpackage go1.x-openssl-libstd for compiled shared object libstd.so. (jsc#PED-1962)
    - Ensure VERSION file is present in GOROOT as required by go tool dist and go tool distpack (bsc#1219988)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0100 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-45288:
    An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive     number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and     CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is     allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an     HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to     be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the     receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header     frames we will process before closing a connection.

    CVE-2023-45289:
    When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial     domain, an http.Client does not forward sensitive headers such as Authorization or Cookie. For     example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to     bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly     forwarded.

    CVE-2023-45290:
    When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with     Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed     form were not applied to the memory consumed while reading a single form line. This permits a maliciously     crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory,     potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits     the maximum size of form lines.

    CVE-2024-24783:
    Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause     Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth     to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not     verify client certificates.

    CVE-2024-24784:
    The ParseAddressList function incorrectly handles comments (text within parentheses) within display names.
    Since this is a misalignment with conforming address parsers, it can result in different trust decisions     being made by programs using different parsers.

    CVE-2024-24785:
    If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the     contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject     unexpected content into templates.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8389:01 advisory.

    * golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288)
      * golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect     (CVE-2023-45289)
      * golang: net/[http:](http:) memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)
      * golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm     (CVE-2024-24783)
      * golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784)
      * golang: html/template: errors returned from MarshalJSON methods may break template escaping     (CVE-2024-24785)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:3428 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * golang: html/template: errors returned from MarshalJSON methods may break template escaping     (CVE-2024-24785)

    * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate     (CVE-2025-61729)

    * github.com/sirupsen/logrus: github.com/sirupsen/logrus: Denial-of-Service due to large single-line     payload (CVE-2025-65637)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the go package has been released.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2562 advisory.

    - Fix CVE-2024-1394
    - Fix CVE-2023-45288

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778109988 advisory.

  - Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12     and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly     fails to reject the header as invalid. (CVE-2022-1705)

  - An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server     connections contain a cache of HTTP header keys sent by the client. While the total number of entries in     this cache is capped, an attacker sending very large keys can cause the server to allocate approximately     64 MiB per open connection. (CVE-2022-41717)

  - The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host     header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send     requests containing an invalid Request.Host or Request.URL.Host value. (CVE-2023-29406)

  - The html/template package does not properly handle HTML-like  comment tokens, nor hashbang #! comment     tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of     <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS     attack. (CVE-2023-39318)

  - The html/template package does not apply the proper rules for handling occurrences of <script, <!--,     and </script within JS literals in <script> contexts. This may cause the template parser to improperly     consider script contexts to be terminated early, causing actions to be improperly escaped. This could be     leveraged to perform an XSS attack. (CVE-2023-39319)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1006 advisory.

    This advisory aggregates security fixes for the golang SRPM in CIQ LTS 9.2. It addresses 9 CVEs:
    CVE-2024-24783, CVE-2024-24785, CVE-2024-1394, CVE-2023-45289, CVE-2023-45288, and 4 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
209811	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.21-openssl (SUSE-SU-2024:3755-1)	Nessus	SuSE Local Security Checks	10/27/2024	10/27/2024	critical
209897	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.22-openssl (SUSE-SU-2024:3772-1)	Nessus	SuSE Local Security Checks	10/30/2024	6/26/2026	critical
236062	Alibaba Cloud Linux 3 : 0100: go-toolset:rhel8 (ALINUX3-SA-2024:0100)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/14/2025	high
293156	MiracleLinux 8 : go-toolset:rhel8 (AXSA:2024-8389:01)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	high
300452	RHEL 8 : container-tools:rhel8 (RHSA-2026:3428)	Nessus	Red Hat Local Security Checks	3/3/2026	3/3/2026	high
333727	Photon OS 5.0: Go PHSA-2026-5.0-91-0869	Nessus	PhotonOS Local Security Checks	8/10/2026	8/12/2026	medium
195158	Oracle Linux 9 : golang (ELSA-2024-2562)	Nessus	Oracle Linux Local Security Checks	5/8/2024	9/9/2025	high
361819	AlmaLinux 9.2 [TuxCare] Security Update: toolbox / toolbox-tests Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1778109988)	Nessus	Alma Linux Local Security Checks	10/1/2026	10/1/2026	medium
353518	Rocky Linux 9.2 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (ciqsa-2026_1006)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/12/2026	critical

Detections

Analytics

Plugins Search

critical

critical

high

high

high

medium

high

medium

critical