RLSA-2026:98592: Important: go-fdo-client security update
go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding.
Security Fix(es):
crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/go-fdo-clientto a version that resolves this vulnerability.Fixed in 0:1.0.0-9.el10_3.11 - Upgrade
Upgrade
rocky-linux/go-fdo-client-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.0.0-9.el10_3.11 - Upgrade
Upgrade
rocky-linux/go-fdo-client-debugsourceto a version that resolves this vulnerability.Fixed in 0:1.0.0-9.el10_3.11
Event History
Frequently Asked Questions
What kinds of remote traffic can trigger the denial-of-service conditions?
The update addresses indefinite TLS KeyUpdate messages and excessive HTTP/2 SETTINGS frames. The provided CVSS vector indicates network-reachable exploitation with no required privileges or user interaction.
What impact is identified for affected systems?
Both listed fixes concern denial of service. The CVSS vector indicates high availability impact, with no stated confidentiality or integrity impact.
Which Rocky Linux packages are covered by this advisory?
The advisory lists rocky-linux/go-fdo-client, rocky-linux/go-fdo-client-debuginfo, and rocky-linux/go-fdo-client-debugsource.