RHSA-2026:97288: Important: yggdrasil security, bug fix, and enhancement update
yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker.Security Fix(es): crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137) Bug Fix(es) and Enhancement(s): [Azure][RHEL-10][yggd]failed to publish message: not Connected (JIRA:RHEL-135848) Set the MQTT LastWill message each time the client connects to the broker (JIRA:RHEL-166873) Yggdrasil: add "client-id" subcommand to yggctl (JIRA:RHEL-178895) Yggdrasil SQL Injection Through DBus (JIRA:RHEL-90808) fix: set HTTP client timeout and max idle connection timeout (JIRA:RHEL-168913) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 10 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/yggdrasilto a version that resolves this vulnerability.Fixed in 0.4.10-1.el10 - Upgrade
Upgrade
redhat/yggdrasil-debuginfoto a version that resolves this vulnerability.Fixed in 0.4.10-1.el10 - Upgrade
Upgrade
redhat/yggdrasil-debugsourceto a version that resolves this vulnerability.Fixed in 0.4.10-1.el10 - Upgrade
Upgrade
redhat/yggdrasil-examples-debuginfoto a version that resolves this vulnerability.Fixed in 0.4.10-1.el10 - Upgrade
Upgrade
redhat/yggdrasilto a version that resolves this vulnerability.Fixed in 0.4.10-1.el10.aa - Upgrade
Upgrade
redhat/yggdrasil-debuginfoto a version that resolves this vulnerability.Fixed in 0.4.10-1.el10.aa - Upgrade
Upgrade
redhat/yggdrasil-debugsourceto a version that resolves this vulnerability.Fixed in 0.4.10-1.el10.aa - Upgrade
Upgrade
redhat/yggdrasil-examples-debuginfoto a version that resolves this vulnerability.Fixed in 0.4.10-1.el10.aa - Upgrade
Upgrade
redhat/yggdrasil-develto a version that resolves this vulnerability.Fixed in 0.4.10-1.el10 - Upgrade
Upgrade
redhat/yggdrasil-develto a version that resolves this vulnerability.Fixed in 0.4.10-1.el10.aa
Event History
Frequently Asked Questions
Which packages are covered by this update?
The update covers redhat/yggdrasil and its debuginfo, debugsource, examples-debuginfo, and devel packages.
Are there operational changes to consider when deploying this update?
The update changes MQTT behavior by setting the LastWill message on every broker connection and includes a fix for publishing failures when the client is not connected. It also adds a client-id subcommand to yggctl and sets HTTP client and idle-connection timeouts.
Does the advisory provide a temporary mitigation or fixed package version?
No temporary mitigation, fixed package version, CVSS score, or configuration-based workaround is provided in the advisory data.