An update of the go package has been released.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:16498 advisory.

    The golang packages provide the Go programming language compiler.

    Security Fix(es):

    * cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names     (CVE-2026-27140)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:10704 advisory.

    Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

    Security Fix(es):

    * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

    * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages     (CVE-2026-32283)

    * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building     (CVE-2026-32280)

    * golang: cmd/compile: no-op interface conversion bypasses overlap checking (CVE-2026-27144)

    * cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names     (CVE-2026-27140)

    * golang: cmd/compile: possible memory corruption after bound check elimination (CVE-2026-27143)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781089493 advisory.

  - SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code     execution at build time due to trust layer bypass. (CVE-2026-27140)

  - The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface     conversion prevented the compiler from making the correct determination about non-overlapping moves,     potentially leading to memory corruption at runtime. (CVE-2026-27144)

  - Validating certificate chains which use policies is unexpectedly inefficient when certificates in the     chain contain a very large number of policy mappings, possibly causing denial of service. This only     affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots     CertPool, or in the system certificate pool. (CVE-2026-32281)

  - When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of     C memory and a crash. (CVE-2026-33811)

  - When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION     frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. (CVE-2026-33814)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS     if the meta tag also has an http-equiv attribute with the value 'refresh'. A new GODEBUG setting has been     added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content     attribute which follow 'url=' by setting htmlmetacontenturlescape=0.(CVE-2026-27142)

    SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code     execution at build time due to trust layer bypass.(CVE-2026-27140)

    tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive     containing a large number of sparse regions encoded in the 'old GNU sparse map' format.(CVE-2026-32288)

Tenable has extracted the preceding description block directly from the EulerOS golang security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive     containing a large number of sparse regions encoded in the 'old GNU sparse map' format.(CVE-2026-32288)

    SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code     execution at build time due to trust layer bypass.(CVE-2026-27140)

Tenable has extracted the preceding description block directly from the EulerOS golang security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1581-1 advisory.

    - Update to go1.25.9 (bsc#1244485).
    - CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG (bsc#1261653).
    - CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination (bsc#1261654).
    - CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking (bsc#1261655).
    - CVE-2026-32280: crypto/x509: unexpected work during chain building (bsc#1261656).
    - CVE-2026-32281: crypto/x509: inefficient policy validation (bsc#1261657).
    - CVE-2026-32282: os: Root.Chmod can follow symlinks out of the root on Linux (bsc#1261658).
    - CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock     (bsc#1261659).
    - CVE-2026-32288: archive/tar: unbounded allocation when parsing old format GNU sparse map (bsc#1261660).
    - CVE-2026-32289: html/template: JS template literal context incorrectly tracked (bsc#1261661).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of golang installed on the remote host is prior to 1.25.9-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3259 advisory.

    SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code     execution at build time in the Go toolchain (cmd/go) due to trust layer bypass. (CVE-2026-27140)

    Arithmetic over induction variables in loops were not correctly checked for underflow or overflow in the     Go compiler (cmd/compile). As a result, the compiler would allow for invalid indexing to occur at runtime,     potentially leading to memory corruption in programs compiled with affected Go versions. (CVE-2026-27143)

    The Go compiler (cmd/compile) incorrectly handled no-op interface conversions, preventing correct     determination about non-overlapping memory moves, potentially leading to memory corruption at runtime in     programs compiled with affected Go versions. (CVE-2026-27144)

    During chain building, the amount of work that is done is not correctly limited when a large number of     intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of     service. This affects both direct users of crypto/x509 and users of crypto/tls. (CVE-2026-32280)

    Validating certificate chains which use policies is unexpectedly inefficient when certificates in the     chain contain a very large number of policy mappings, possibly causing denial of service. This only     affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots     CertPool, or in the system certificate pool. (CVE-2026-32281)

    On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress,     Chmod can operate on the target of the symlink, even when the target lies outside the root.
    (CVE-2026-32282)

    If one side of the TLS connection sends multiple key update messages post-handshake in a single record,     the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of     service. This only affects TLS 1.3. (CVE-2026-32283)

    tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive     containing a large number of sparse regions encoded in the old GNU sparse map format. (CVE-2026-32288)

    Context was not properly tracked across template branches for JS template literals, leading to possibly     incorrect escaping of content. This could cause actions within JS template literals to be incorrectly     escaped, leading to XSS vulnerabilities. (CVE-2026-32289)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20703-1 advisory.

    Changes in coredns:

    - Update to version 1.14.3:
      * This release introduces Windows service support, along with full TSIG         verification across DoH, DoH3, QUIC, and gRPC transports, and improved         TSIG propagation and DoH request validation.
      * It also adds optional TLS for the metrics endpoint.
      * Performance and stability are improved through cache prefetching, QUIC         optimizations, and a new max_age option in the forward plugin.
      * Additional updates include enhanced SVCB/HTTPS support, improved zone         transfer behavior, and various DNSSEC, PROXY protocol, and concurrency         fixes.
      * The release is built with Go 1.26.2, which includes security         fixes addressing CVE-2026-32282, CVE-2026-32289, CVE-2026-33810,         CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283,         and CVE-2026-27140, and also includes fixes for CVE-2026-32936,         CVE-2026-33190, CVE-2026-33489, CVE-2026-32934, and CVE-2026-35579.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
320798	Photon OS 5.0: Go PHSA-2026-5.0-0869	Nessus	PhotonOS Local Security Checks	6/12/2026	10/14/2026	medium
314359	RHEL 9 : golang (RHSA-2026:16498)	Nessus	Red Hat Local Security Checks	5/12/2026	5/12/2026	high
333727	Photon OS 5.0: Go PHSA-2026-5.0-91-0869	Nessus	PhotonOS Local Security Checks	8/10/2026	8/12/2026	medium
312824	RHEL 8 : go-toolset:rhel8 (RHSA-2026:10704)	Nessus	Red Hat Local Security Checks	5/6/2026	5/6/2026	critical
352613	Rocky Linux 9.6 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1781089493)	Nessus	Rocky Linux Local Security Checks	9/30/2026	9/30/2026	high
326130	EulerOS 2.0 SP12 : golang (EulerOS-SA-2026-2531)	Nessus	Huawei Local Security Checks	7/10/2026	7/10/2026	high
333453	EulerOS 2.0 SP11 : golang (EulerOS-SA-2026-3068)	Nessus	Huawei Local Security Checks	8/8/2026	8/8/2026	high
310227	SUSE SLES15 Security Update : go1.25-openssl (SUSE-SU-2026:1581-1)	Nessus	SuSE Local Security Checks	4/25/2026	4/25/2026	critical
311200	Amazon Linux 2 : golang, --advisory ALAS2-2026-3259 (ALAS-2026-3259)	Nessus	Amazon Linux Local Security Checks	4/30/2026	4/30/2026	critical
313705	openSUSE 16 Security Update : coredns (openSUSE-SU-2026:20703-1)	Nessus	SuSE Local Security Checks	5/10/2026	5/10/2026	high

Detections

Analytics

Plugins Search

medium

high

medium

critical

high

high

high

critical

critical

high