RLSA-2026:97386: Important: go-fdo-client security update
go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding.
Security Fix(es):
crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)
net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/go-fdo-client-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.0.0-9.el10_3 - Upgrade
Upgrade
rocky-linux/go-fdo-clientto a version that resolves this vulnerability.Fixed in 0:1.0.0-9.el10_3 - Upgrade
Upgrade
rocky-linux/go-fdo-client-debugsourceto a version that resolves this vulnerability.Fixed in 0:1.0.0-9.el10_3
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which package variants are covered by this advisory?
The advisory covers rocky-linux/go-fdo-client, rocky-linux/go-fdo-client-debuginfo, and rocky-linux/go-fdo-client-debugsource.
Which security issues are addressed in this release?
It addresses CVE-2026-27137, CVE-2026-25679, CVE-2026-33811, and CVE-2026-39821, affecting Go crypto/x509, net/url, net LookupCNAME handling, and golang.org/x/net/idna respectively.