The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2025_7467 advisory.

    * go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:3593 advisory.

    Collector with the supported components for a Red Hat build of OpenTelemetry

    Security Fix(es):

    * golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect     (CVE-2024-45336)

    * go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)

    * golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws     (CVE-2025-22868)

    * github.com/expr-lang/expr: Memory Exhaustion in Expr Parser with Unrestricted Input (CVE-2025-29786)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-5fce1e4f70 advisory.

    Rebase to Incus 6.12 to fix a variety of issues

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1766049566 advisory.

  - Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go,     including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT)     standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go     JOSE could use excessive memory. The code used strings.Split(token, .) to split JWT tokens, which is     vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number     of `.` characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory     exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could     pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.
    (CVE-2025-27144)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. In versions     1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs     files through the use of a racing container with shared mounts (we have also verified this attack is     possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering     parallel execution of containers with custom shared mounts configured). This redirect could be through     symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the     mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused     runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in     versions 1.2.8, 1.3.3, and 1.4.0-rc.3. (CVE-2025-52881)

  - tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0     sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader     to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a     small compressed input can result in large allocations. (CVE-2025-58183)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
356092	Rocky Linux 10.0 [CIQ] Security Update: skopeo / skopeo-debuginfo / skopeo-debugsource / skopeo-tests (crlsa-2025_7467)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/1/2026	high
277007	openSUSE 16 Security Update : trivy (openSUSE-SU-2025-20117-1)	Nessus	SuSE Local Security Checks	12/2/2025	12/2/2025	medium
233934	RHEL 9 : opentelemetry-collector (RHSA-2025:3593)	Nessus	Red Hat Local Security Checks	4/5/2025	6/5/2025	high
235448	Fedora 41 : incus (2025-5fce1e4f70)	Nessus	Fedora Local Security Checks	5/7/2025	6/28/2025	high
315032	openSUSE 16 Security Update : apptainer (openSUSE-SU-2026:20730-1)	Nessus	SuSE Local Security Checks	5/16/2026	5/16/2026	high
359930	Rocky Linux 9.6 [TuxCare] Security Update: buildah / buildah-tests Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2025:1766049566)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/1/2026	high

Detections

Analytics

Plugins Search

high

medium

high

high

high

high