RHSA-2026:97386: Important: go-fdo-client security update
go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding.Security Fix(es): crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137) net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 10 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/go-fdo-clientto a version that resolves this vulnerability.Fixed in 1.0.0-9.el10_3 - Upgrade
Upgrade
redhat/go-fdo-client-debuginfoto a version that resolves this vulnerability.Fixed in 1.0.0-9.el10_3 - Upgrade
Upgrade
redhat/go-fdo-client-debugsourceto a version that resolves this vulnerability.Fixed in 1.0.0-9.el10_3 - Upgrade
Upgrade
redhat/go-fdo-clientto a version that resolves this vulnerability.Fixed in 1.0.0-9.el10_3.aa - Upgrade
Upgrade
redhat/go-fdo-client-debuginfoto a version that resolves this vulnerability.Fixed in 1.0.0-9.el10_3.aa - Upgrade
Upgrade
redhat/go-fdo-client-debugsourceto a version that resolves this vulnerability.Fixed in 1.0.0-9.el10_3.aa
Event History
Frequently Asked Questions
Which installed packages should be checked when determining whether this update applies?
Check for redhat/go-fdo-client, redhat/go-fdo-client-debuginfo, and redhat/go-fdo-client-debugsource. The advisory does not provide affected or fixed package version numbers.
Can this advisory alone confirm whether a particular system is vulnerable?
No. It identifies the affected package names and included CVEs, but does not include installed-version criteria, affected configurations, or exploitation indicators.
What types of security issues are included in this update?
The update addresses incorrect email-constraint enforcement in crypto/x509, IPv6 host-literal parsing in net/url, a LookupCNAME denial of service in net, and privilege escalation through incorrect Punycode label processing in golang.org/x/net/idna.