RHSA-2026:99087: Important: go-fdo-client security update

Q: Which deployments should prioritize this update?

Deployments using the go-fdo-client device-side FIDO Device Onboard client on the listed Red Hat Enterprise Linux x86_64 or ARM 64 update and lifecycle channels should prioritize it. The affected component communicates with FDO manufacturer and owner servers during device onboarding.

Q: What attack conditions are identified by the included fixes?

One fix addresses denial of service through excessive HTTP/2 SETTINGS frames, indicating exposure where the client processes HTTP/2 traffic. The other addresses man-in-the-middle attacks involving untrusted intermediate certificates, indicating risk where certificate-chain validation can be influenced during communications.

Q: Which specific CVEs are addressed?

The update addresses CVE-2026-78669, an HTTP/2 SETTINGS-frame denial-of-service issue, and CVE-2026-111943, a crypto/x509 certificate-validation issue that can enable man-in-the-middle attacks.

Published Nov 11, 2026

Updated

go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding.Security Fix(es): net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Other sources

Important: go-fdo-client security update

— Red Hat

Affected Software

13 affected componentsFixes available

Red Hat Red Hat Enterprise Linux for x86_64 - Extended Life Cycle

Red Hat Red Hat Enterprise Linux for x86_64 - Extended Update Support

Red Hat Red Hat Enterprise Linux for ARM 64 - 4 years of updates

Red Hat Red Hat Enterprise Linux for x86_64 - 4 years of updates

Red Hat Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle

Red Hat Red Hat Enterprise Linux for ARM 64 - Extended Update Support

redhat/go-fdo-client<1.0.0-4.el10_2.9

1.0.0-4.el10_2.9

redhat/go-fdo-client<1.0.0-4.el10_2.9

1.0.0-4.el10_2.9

redhat/go-fdo-client-debuginfo<1.0.0-4.el10_2.9

1.0.0-4.el10_2.9

redhat/go-fdo-client-debugsource<1.0.0-4.el10_2.9

1.0.0-4.el10_2.9

redhat/go-fdo-client<1.0.0-4.el10_2.9.aa

1.0.0-4.el10_2.9.aa

redhat/go-fdo-client-debuginfo<1.0.0-4.el10_2.9.aa

1.0.0-4.el10_2.9.aa

redhat/go-fdo-client-debugsource<1.0.0-4.el10_2.9.aa

1.0.0-4.el10_2.9.aa

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/go-fdo-client to a version that resolves this vulnerability.
Fixed in 1.0.0-4.el10_2.9
Upgrade
Upgrade redhat/go-fdo-client-debuginfo to a version that resolves this vulnerability.
Fixed in 1.0.0-4.el10_2.9
Upgrade
Upgrade redhat/go-fdo-client-debugsource to a version that resolves this vulnerability.
Fixed in 1.0.0-4.el10_2.9
Upgrade
Upgrade redhat/go-fdo-client to a version that resolves this vulnerability.
Fixed in 1.0.0-4.el10_2.9.aa
Upgrade
Upgrade redhat/go-fdo-client-debuginfo to a version that resolves this vulnerability.
Fixed in 1.0.0-4.el10_2.9.aa
Upgrade
Upgrade redhat/go-fdo-client-debugsource to a version that resolves this vulnerability.
Fixed in 1.0.0-4.el10_2.9.aa

Event History

Nov 11, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Advisory Published

via Red Hat·05:51 PM

Data Sourced

via Red Hat·05:51 PM

Severity

Frequently Asked Questions

Which deployments should prioritize this update?

Deployments using the go-fdo-client device-side FIDO Device Onboard client on the listed Red Hat Enterprise Linux x86_64 or ARM 64 update and lifecycle channels should prioritize it. The affected component communicates with FDO manufacturer and owner servers during device onboarding.

What attack conditions are identified by the included fixes?

One fix addresses denial of service through excessive HTTP/2 SETTINGS frames, indicating exposure where the client processes HTTP/2 traffic. The other addresses man-in-the-middle attacks involving untrusted intermediate certificates, indicating risk where certificate-chain validation can be influenced during communications.

Which specific CVEs are addressed?

The update addresses CVE-2026-78669, an HTTP/2 SETTINGS-frame denial-of-service issue, and CVE-2026-111943, a crypto/x509 certificate-validation issue that can enable man-in-the-middle attacks.

RHSA-2026:99087: Important: go-fdo-client security update

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments should prioritize this update?

What attack conditions are identified by the included fixes?

Which specific CVEs are addressed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should prioritize this update?

What attack conditions are identified by the included fixes?

Which specific CVEs are addressed?