Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
go-fdo-client may let attackers bypass certificates and cause crashes
published 2 months ago
Summary
The go-fdo-client program, which helps devices join a network, has several flaws that could let a malicious party skip security checks on certificates and potentially crash or hang the software. These issues could disrupt device onboarding or expose the system to unauthorized access. Apply the latest software update as soon as possible to fix the problems.
What to do
- Update rocky go-fdo-client to version 0:1.0.0-4.el10_2.7.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Rocky Linux:10 | rocky | go-fdo-client |
< 0:1.0.0-4.el10_2.7 Fix: upgrade to 0:1.0.0-4.el10_2.7
|
Original advisory text
Important: go-fdo-client security update
go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding.
Security Fix(es):
* crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)
* encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
* net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
* crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)
* encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
* net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
* crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://errata.rockylinux.org/RLSA-2026:62577 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2515820 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2456335 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2515815 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2515839 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:62577 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published3 Sep 2026
Updated3 Sep 2026
First seen3 Sep 2026
Sources
RLSA-2026:62577 · OSV
Track software like this
Free during beta