RLSA-2026:97387: Important: go-fdo-server security update
This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location.
Security Fix(es):
crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)
net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/go-fdo-serverto a version that resolves this vulnerability.Fixed in 0:1.0.1-6.el10_3 - Upgrade
Upgrade
rocky-linux/go-fdo-server-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.0.1-6.el10_3 - Upgrade
Upgrade
rocky-linux/go-fdo-server-debugsourceto a version that resolves this vulnerability.Fixed in 0:1.0.1-6.el10_3 - Upgrade
Upgrade
rocky-linux/go-fdo-server-manufacturerto a version that resolves this vulnerability.Fixed in 0:1.0.1-6.el10_3 - Upgrade
Upgrade
rocky-linux/go-fdo-server-ownerto a version that resolves this vulnerability.Fixed in 0:1.0.1-6.el10_3 - Upgrade
Upgrade
rocky-linux/go-fdo-server-rendezvousto a version that resolves this vulnerability.Fixed in 0:1.0.1-6.el10_3
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which installed components should be reviewed for this update?
Review go-fdo-server and its related packages: go-fdo-server-debuginfo, go-fdo-server-debugsource, go-fdo-server-manufacturer, go-fdo-server-owner, and go-fdo-server-rendezvous.
Does the reported severity indicate that an attacker needs credentials or user interaction?
The reported CVSS vector is network-accessible with low attack complexity and specifies no privileges and no user interaction. It rates the primary impact as high availability impact, with no reported confidentiality or integrity impact.
What denial-of-service conditions are addressed by the update?
The update includes fixes for denial of service through a long CNAME response processed by LookupCNAME and through excessive XML decoding recursion depth. It also includes fixes for incorrect X.509 email-constraint enforcement and IPv6 host-literal parsing.