The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:4672 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip     (CVE-2025-61728)

    * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

    * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:4672 advisory.

    * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip     (CVE-2025-61728)
      * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)
      * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-4672 advisory.

    - rebuild for CVE-2025-68121
    - rebuild for CVE-2025-61729
    - fixes 'CVE-2025-47913 container-tools:rhel8/buildah: golang.org/x/crypto/ssh/agent: SSH client panic due     to unexpected SSH_AGENT_SUCCESS [rhel-8.10.z]'
    - fixes '[Minor Incident] CVE-2025-52881 container-tools:rhel8/buildah: container escape and denial of     service due to arbitrary write gadgets and procfs write redirects [rhel-8.10.z]'
    - rebuild for CVE-2025-58183
    - fixes 'CVE-2025-22871 container-tools:rhel8/buildah: Request smuggling due to acceptance of invalid     chunked data in net/http [rhel-8.10.z]'
    - rebuild for CVE-2025-68121
    - rebuild for CVE-2025-61729
    - rebuild for CVE-2025-22871
    - rebuild for CVE-2024-1394
    - Fix CVE-2021-3592 CVE-2021-3593 CVE-2021-3594 CVE-2021-3595 out-of-bounds access
    - replace patch for CVE-2020-10756 with dedicated upstream one
    - fix 'CVE-2020-10756 QEMU: slirp: networking out-of-bounds read information disclosure vulnerability'
    - CVE-2020-1983 fix
    - rebuild for CVE-2025-68121
    - fixes 'CVE-2025-47913 container-tools:rhel8/podman: golang.org/x/crypto/ssh/agent: SSH client panic due     to unexpected SSH_AGENT_SUCCESS [rhel-8.10.z]'
    - fixes '[Minor Incident] CVE-2025-52881 container-tools:rhel8/podman: container escape and denial of     service due to arbitrary write gadgets and procfs write redirects [rhel-8.10.z]'
    - rebuild for CVE-2025-58183
    - fixes 'CVE-2025-9566 container-tools:rhel8/podman: Podman kube play command may overwrite host files     [rhel-8.10.z]'
    - fixes 'CVE-2025-6032 container-tools:rhel8/podman: podman missing TLS verification [rhel-8.10.z]'
    - rebuild for CVE-2025-68121
    - rebuild for CVE-2025-61729
    - fix CVE-2025-31133 CVE-2025-52565 CVE-2025-52881
    - rebuild for CVE-2024-1394
    - rebuild for CVE-2025-68121
    - rebuild for CVE-2025-61729
    - rebuild for CVE-2025-58183
    - rebuild for CVE-2025-22871
    - rebuild for CVE-2024-24786

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:22450 advisory.

    A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild     under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It     is compatible with composer-cli and cockpit-composer clients.

    Security Fix(es):

    * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip     (CVE-2025-61728)

    * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

    * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

    * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

    * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    * github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message     (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)

    * google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to     improper HTTP/2 path validation (CVE-2026-33186)

    * github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL     server (CVE-2026-32286)

    * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted     JSON Web Encryption (JWE) object (CVE-2026-34986)

    * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

    * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages     (CVE-2026-32283)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-22714 advisory.

    [175-1.0.1]
    - Track github upstream

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
302751	RHEL 8 : container-tools:rhel8 (RHSA-2026:4672)	Nessus	Red Hat Local Security Checks	3/17/2026	3/17/2026	critical
302803	AlmaLinux 8 : container-tools:rhel8 (ALSA-2026:4672)	Nessus	Alma Linux Local Security Checks	3/17/2026	3/17/2026	critical
302824	Oracle Linux 8 : container-tools:rhel8 (ELSA-2026-4672)	Nessus	Oracle Linux Local Security Checks	3/17/2026	3/17/2026	critical
319504	RHEL 10 : osbuild-composer (RHSA-2026:22450)	Nessus	Red Hat Local Security Checks	6/6/2026	6/6/2026	critical
332979	Oracle Linux 9 : osbuild-composer (ELSA-2026-22714)	Nessus	Oracle Linux Local Security Checks	8/6/2026	8/6/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical