RLSA-2026:98593: Important: go-fdo-server security update
This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location.
Security Fix(es):
encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/go-fdo-server-debugsourceto a version that resolves this vulnerability.Fixed in 0:1.0.1-6.el10_3.9 - Upgrade
Upgrade
rocky-linux/go-fdo-serverto a version that resolves this vulnerability.Fixed in 0:1.0.1-6.el10_3.9 - Upgrade
Upgrade
rocky-linux/go-fdo-server-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.0.1-6.el10_3.9 - Upgrade
Upgrade
rocky-linux/go-fdo-server-manufacturerto a version that resolves this vulnerability.Fixed in 0:1.0.1-6.el10_3.9 - Upgrade
Upgrade
rocky-linux/go-fdo-server-rendezvousto a version that resolves this vulnerability.Fixed in 0:1.0.1-6.el10_3.9 - Upgrade
Upgrade
rocky-linux/go-fdo-server-ownerto a version that resolves this vulnerability.Fixed in 0:1.0.1-6.el10_3.9
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which deployments are most exposed to these issues?
Deployments running the go-fdo-server components are in scope, including the manufacturer, rendezvous, and owner services. The listed flaws are denial-of-service issues in Go libraries used for ASN.1 parsing, HTTP/2, and TLS.
Does exploitation require authentication or user interaction?
No. The supplied severity vector specifies network access, low attack complexity, no privileges required, and no user interaction, indicating that a remote unauthenticated attacker may be able to trigger the affected denial-of-service conditions.
What operational impact should be expected?
The stated impact is availability loss: confidentiality and integrity are listed as unaffected, while availability is rated high. Successful exploitation could disrupt service operation through resource exhaustion or protocol-message handling.