According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a     handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages     to force the server to keep performing key derivation operations indefinitely.(CVE-2026-56862)

    During chain building, the amount of work that is done is not correctly limited when a large number of     intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of     service. This affects both direct users of crypto/x509 and users of crypto/tls.(CVE-2026-32280)

    Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive     structures.(CVE-2026-33818)

    Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack     exhaustion.(CVE-2026-56859)

    A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass     checksum database validation. This vulnerability affects any user using an untrusted module proxy     (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can serve altered versions of the Go     toolchain. When selecting a different version of the Go toolchain than the currently installed toolchain     (due to the GOTOOLCHAIN environment variable, or a go.work or go.mod with a toolchain line), the go     command will download and execute a toolchain provided by the module proxy. A malicious module proxy can     bypass checksum database validation for this downloaded toolchain. Since this vulnerability affects the     security of toolchain downloads, setting GOTOOLCHAIN to a fixed version is not sufficient. You must     upgrade your base Go toolchain. The go tool always validates the hash of a toolchain before executing it,     so fixed versions will refuse to execute any cached, altered versions of the toolchain. The go tool trusts     go.sum files to contain accurate hashes of the current module's dependencies. A malicious proxy exploiting     this vulnerability to serve an altered module will have caused an incorrect hash to be recorded in the     go.sum. Users who have configured a non-trusted GOPROXY can determine if they have been affected by     running 'rm go.sum ; go mod tidy ; go mod verify', which will revalidate all dependencies of the current     module. The specific flaw in more detail: The go command consults the checksum database to validate     downloaded modules, when a module is not listed in the go.sum file. It verifies that the module hash     reported by the checksum database matches the hash of the downloaded module. If, however, the checksum     database returns a successful response that contains no entry for the module, the go command incorrectly     permitted validation to succeed. A module proxy may mirror or proxy the checksum database, in which case     the go command will not connect to the checksum database directly. Checksums reported by the checksum     database are cryptographically signed, so a malicious proxy cannot alter the reported checksum for a     module. However, a proxy which returns an empty checksum response, or a checksum response for an unrelated     module, could cause the go command to proceed as if a downloaded module has been     validated.(CVE-2026-42501)

    A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested     module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module     cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be     detected by evaluating the transparency log. All tiles are now correctly verified against their parents.
    In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/  go mod     tidy(CVE-2026-56865)

    A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency     log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content     that cannot be detected by evaluating the transparency log. In order to determine if you have been     affected:   rm -r go.sum go.work.sum vendor/  go mod tidy(CVE-2026-56864)

    The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL     (0).(CVE-2026-39836)

    When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection     to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when     doing this.(CVE-2026-56853)

    Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request     handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-2023-39325,     the 'Rapid Reset' technique). A remote attacker can rapidly create and cancel HTTP/2 streams to exhaust     server resources and cause service unavailability.(CVE-2023-54365)

Tenable has extracted the preceding description block directly from the EulerOS golang security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
376868	EulerOS 2.0 SP12 : golang (EulerOS-SA-2026-4408)	Nessus	Huawei Local Security Checks	2026/11/6	2026/11/6	high
376780	EulerOS 2.0 SP12 : golang (EulerOS-SA-2026-4485)	Nessus	Huawei Local Security Checks	2026/11/6	2026/11/6	high

偵測

搜尋 Plugin

high

high