The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c7450bfed6 advisory.

    Update to upstream 2.5.3, fix CVE-2026-34986, CVE-2026-39388, CVE-2026-39396, CVE-2026-40264


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20686-1 advisory.

    This update for distribution fixes the following issues

    Security issues:

    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2:
    path pseudo-       header (bsc#1260283).
    - CVE-2026-33540: information disclosure via improper validation of authentication realm URL     (bsc#1261793).
    - CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead     to a denial of       service (bsc#1262951).
    - CVE-2026-35172: information disclosure via stale references after content deletion (bsc#1262096).

    Non security issues:

    - add distribution-registry.tmpfiles (jsc#PED-14747).
    - distribution builds against go1.24 EOL (bsc#1259718).

    Changes for distribution:

    - update to 3.1.0

     * Adds support for tag pagination
     * Fixes default credentials in Azure storage provider
     * Drops support for go1.23 and go1.24 and updates to go1.25
     * See the full changelog below for the full list of changes.
     * docs: Update to refer to new image tag v3
     * Fix default_credentials in azure storage provider
     * chore: make function comment match function name
     * build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 in      the go_modules group across 1 directory
     * fix: implement JWK thumbprint for Ed25519 public keys
     * fix: Annotate code block from validation.indexes      configuration docs
     * feat: extract redis config to separate struct
     * Fix: resolve issue #4478 by using a temporary file for non-      append writes
     * build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2
     * docs: Add note about `OTEL_TRACES_EXPORTER`
     * fix: set OTEL traces to disabled by default
     * Fix markdown syntax for OTEL traces link in docs
     * Switch UUIDs to UUIDv7
     * refactor: replace map iteration with maps.Copy/Clone
     * s3-aws: fix build for 386
     * docs: Add OpenTelemetry links to quickstart docs
     * Fix S3 driver loglevel param
     * Fixed data race in TestSchedule test
     * Fixes #4683 - uses X/Y instead of Gx/Gy for thumbprint of      ecdsa keys
     * build(deps): bump actions/checkout from 4 to 5
     * Fix broken link to Docker Hub fair use policy
     * fix(registry/handlers/app): redis CAs
     * build(deps): bump actions/labeler from 5 to 6
     * build(deps): bump actions/setup-go from 5 to 6
     * build(deps): bump actions/upload-pages-artifact from 3 to 4
     * build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3
     * build(deps): bump github/codeql-action from 3.26.5 to 4.30.7
     * build(deps): bump github/codeql-action from 4.30.7 to 4.30.8
     * chore: labeler: add area/client mapping for      internal/client/**
     * client: add Accept headers to Exists() HEAD
     * feat(registry): Make graceful shutdown test robust
     * fix(registry): Correct log formatting for upstream challenge
     * build(deps): bump github/codeql-action from 4.30.8 to 4.30.9
     * build(deps): bump github/codeql-action from 4.30.9 to 4.31.3
     * refactor: remove redundant variable declarations in for loops
     * should -> must regarding redis eviction policy
     * build(deps): bump actions/checkout from 5 to 6
     * Incorrect warning hint
     * Add return error when list object
     * build(deps): bump actions/checkout from 5.0.1 to 6.0.0
     * build(deps): bump peter-evans/dockerhub-description from 4 to      5
     * fix: Logging regression for manifest HEAD requests
     * Add boolean parsing util
     * Expose `useFIPSEndpoint` for S3
     * Add Cloudfleet Container Registry to adopters
     * fix(ci): Fix broken Azure e2e storage tests
     * BUG: Fix notification filtering to work with actions when      mediatypes is empty
     * build(deps): bump actions/checkout from 6.0.0 to 6.0.1
     * build(deps): bump actions/upload-artifact from 4.6.2 to 6.0.0
     * build(deps): bump github/codeql-action from 4.31.3 to 4.31.10
     * build(deps): bump github/codeql-action from 4.31.10 to 4.32.2
     * build(deps): bump actions/checkout from 6.0.1 to 6.0.2
     * update golangci-lint to v2.9 and fix linting issues
     * update to go1.25.7, alpine 3.23, xx v1.9.0
     * vendor: github.com/sirupsen/logrus v1.9.4
     * vendor: update golang.org/x/* dependencies
     * vendor: github.com/docker/docker-credential-helpers v0.9.5
     * vendor: github.com/opencontainers/image-spec v1.1.1
     * vendor: github.com/klauspost/compress v1.18.4
     * fix: prefer otel variables over hard coded service name
     * vendor: github.com/spf13/cobra v1.10.2
     * vendor: github.com/bshuster-repo/logrus-logstash-hook v1.1.0
     * fix: sync parent dir to ensure data is reliably stored
     * modernize code
     * vendor: github.com/docker/go-events 605354379745
     * vendor: github.com/go-jose/go-jose/v4 v4.1.3
     * build(deps): bump github/codeql-action from 4.32.2 to 4.32.5
     * build(deps): bump docker/login-action from 3 to 4
     * build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0
     * build(deps): bump docker/setup-buildx-action from 3 to 4
     * build(deps): bump docker/bake-action from 6 to 7
     * build(deps): bump docker/metadata-action from 5 to 6
     * fix: nil-check scheduler in `proxyingRegistry.Close()`
     * fix: set MD5 on GCS writer before first `Write` call in      `putContent`
     * docs: pull through cache will pull from remote multiple times
     * Update s3.md regionendpoint option
     * chore(deps): Bump Go to latest 1.25 in CI workflows and      go.mod
     * fix: correct Ed25519 JWK thumbprint `kty` from `OTP` to      `OKP`
     * Update vacuum.go
     * Opt: refector tag list pagination support (stage 1)
     * Correctly match environment variables to YAML-inlined structs      in configuration
     * Enable Redis TLS without client certificates
     * build(deps): bump actions/deploy-pages from 4 to 5
     * build(deps): bump github/codeql-action from 4.32.5 to 4.34.1
     * fix(registry/proxy): use detached context when flushing write      buffer
     * ci: pin actions and apply zizmor auto-fixes
     * build(deps): bump actions/setup-go from 6.3.0 to 6.4.0
     * build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to      4.1.4 in the go_modules group across 1 directory
     * chore(app): warn when partial TLS config is used in Redis
     * feat(registry): enhance authentication checks in htpasswd      implementation
     * Opt: refactor tag list pagination support
     * build(deps): bump codecov/codecov-action from 5.5.4 to 6.0.0
     * build(deps): bump actions/configure-pages from 5.0.0 to 6.0.0
     * fix(vendor): fix broke vendor validation
     * chore(ci): Prep for v3.1 release
    - Update to version 3.1.0:
     * fix(vendor): fix broke vendpor validation
     * fix redis repo-scoped blob descriptor revocation
     * proxy: bind bearer realms to upstream trust boundary
    - restore directory ownership after last change
    - Move config files in systemd tmpfiles dir for immutable mode

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:17287 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fix(es):

    * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted     JSON Web Encryption (JWE) object (CVE-2026-34986)

    * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages     (CVE-2026-32283)

    * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building     (CVE-2026-32280)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:19719 advisory.

    Collector with the supported components for a Red Hat build of OpenTelemetry

    Security Fix(es):

    * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    * google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to     improper HTTP/2 path validation (CVE-2026-33186)

    * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted     JSON Web Encryption (JWE) object (CVE-2026-34986)

    * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation     (CVE-2026-32281)

    * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint     application (CVE-2026-33810)

    * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

    * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages     (CVE-2026-32283)

    * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building     (CVE-2026-32280)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20816-1 advisory.

    This update for alloy fixes the following issues

    - CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead     to a denial of       service (bsc#1262955).
    - CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32     integer overflow       (bsc#1263530).

    Changes for alloy:

    - Update to version 1.16.1
     * Bug Fixes      logging: Fix startup deadlock when components log before      logging config is evaluated      Update to Beyla 3.9.8      Migrate from Docker to Moby

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
311376	Fedora 44 : openbao (2026-c7450bfed6)	Nessus	Fedora Local Security Checks	5/1/2026	5/4/2026	low
313696	openSUSE 16 Security Update : distribution (openSUSE-SU-2026:20686-1)	Nessus	SuSE Local Security Checks	5/10/2026	5/10/2026	critical
314515	RHEL 9 : podman (RHSA-2026:17287)	Nessus	Red Hat Local Security Checks	5/14/2026	5/14/2026	high
315952	RHEL 10 : opentelemetry-collector (RHSA-2026:19719)	Nessus	Red Hat Local Security Checks	5/20/2026	5/20/2026	high
317699	openSUSE 16 Security Update : alloy (openSUSE-SU-2026:20816-1)	Nessus	SuSE Local Security Checks	5/29/2026	5/29/2026	high

Detections

Analytics

Plugins Search

low

critical

high

high

high