RLSA-2026:98617: Important: yggdrasil security update
yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker.
Security Fix(es):
crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)
encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/yggdrasil-debugsourceto a version that resolves this vulnerability.Fixed in 0:0.4.10-1.el10_3.4 - Upgrade
Upgrade
rocky-linux/yggdrasilto a version that resolves this vulnerability.Fixed in 0:0.4.10-1.el10_3.4 - Upgrade
Upgrade
rocky-linux/yggdrasil-develto a version that resolves this vulnerability.Fixed in 0:0.4.10-1.el10_3.4 - Upgrade
Upgrade
rocky-linux/yggdrasil-debuginfoto a version that resolves this vulnerability.Fixed in 0:0.4.10-1.el10_3.4
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which deployments are exposed to these denial-of-service issues?
Deployments using the listed Rocky Linux yggdrasil packages are in scope. The advisory identifies denial-of-service flaws in Go components used by the software, but does not specify which yggdrasil interfaces or configurations reach each affected code path.
What can an attacker do if they exploit these flaws?
The listed issues can cause denial of service, including excessive processing of DNS SAN entries, ASN.1 recursion, URL path resolution, TLS KeyUpdate messages, and HTTP/2 SETTINGS frames. The provided CVSS vector indicates network reachability with no privileges or user interaction required.
How can I determine whether a system needs remediation?
Check whether any of the listed packages are installed: yggdrasil, yggdrasil-debugsource, yggdrasil-devel, or yggdrasil-debuginfo from Rocky Linux. The provided advisory data does not include fixed or affected package version numbers.