Critical Security Update for go-fdo-client: Denial of Service Vulnerability
Summary
ALSA-2026:46394: Important: go-fdo-client security update. Affects go-fdo-client versions < 1.0.0-4.el10_2.5. Fixed in 1.0.0-4.el10_2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
go-fdo-client is a Go-based implementation of the FIDO Device Onboard specification, designed to facilitate the onboarding of devices by interacting with FIDO manufacturer and owner servers. This package is crucial for ensuring secure and efficient device management in various applications. However, it has been identified to have a significant vulnerability that could lead to denial of service due to excessive processing of DNS Subject Alternative Name (SAN) entries.
Vulnerability Detail
The vulnerability, identified as CVE-2026-27145, originates from the handling of DNS SAN entries within the crypto/x509 package of Go. An attacker can exploit this vulnerability by crafting DNS responses that contain an excessive number of SAN entries, leading to denial of service. This can cause the application using go-fdo-client to become unresponsive, impacting the availability of services relying on device onboarding.
How To Fix
Minimum fixed version
1.0.0-4.el10_2.5
This is the first release that contains the fix.
sudo dnf update go-fdo-clientTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the security update as soon as it is available.
Conclusion
The go-fdo-client package has a critical vulnerability that could lead to denial of service. It is essential to update to the patched version to mitigate risks. Users are encouraged to utilize tools like Vulert to monitor their applications for vulnerabilities effectively.
See every vulnerability recorded for go-fdo-client →
FAQ
CVE-2026-27145 is a vulnerability in the go-fdo-client package that allows for denial of service through excessive processing of DNS SAN entries.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to denial of service, causing the application to become unresponsive and affecting the availability of services.
Yes, a patch is available in the form of an updated version of the go-fdo-client package, specifically version 1.0.0-4.el10_2.5.
Vulert is a service that monitors and alerts in real-time for open-source vulnerabilities in software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for go-fdo-client.
