Critical Security Flaw in go-fdo-client: Important Update Required
Summary
RLSA-2026:62577: Important: go-fdo-client security update. Affects go-fdo-client versions < 0:1.0.0-4.el10_2.7. Fixed in 0:1.0.0-4.el10_2.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The go-fdo-client is a device-side implementation of the FIDO Device Onboard specification, developed in Go. It facilitates the onboarding of devices by enabling communication between FDO clients and manufacturer/owner servers. This package is crucial for secure device management and onboarding processes in various applications.
Vulnerability Detail
The go-fdo-client has been identified with multiple vulnerabilities that could lead to severe security issues. These include a certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810), a denial of service via excessive recursion in Unmarshal (CVE-2026-33818), quadratic complexity in path resolution leading to denial of service (CVE-2026-56860), and a potential denial of service from indefinite KeyUpdate messages (CVE-2026-56862). The ramifications of these vulnerabilities can range from unauthorized access to complete service outages, making it critical for users to address these issues promptly.
How To Fix
Minimum fixed version
0:1.0.0-4.el10_2.7
This is the first release that contains the fix.
sudo dnf update go-fdo-clientTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing network-level protections to mitigate potential denial of service attacks, such as rate limiting and monitoring for unusual traffic patterns. Additionally, avoid using features that are known to be vulnerable until the update is applied.
Conclusion
The go-fdo-client has critical vulnerabilities that require immediate attention. Users are strongly advised to update to the latest patched version to protect their systems from potential security threats. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for go-fdo-client →
FAQ
The CVSS score of the vulnerabilities in go-fdo-client is 8.8, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerabilities can lead to unauthorized access, denial of service, and potential data breaches, affecting the overall security of systems using go-fdo-client.
While the primary risks are related to unauthorized access and service outages, there is a potential for data loss if attackers exploit these vulnerabilities effectively.
If an immediate update is not possible, implement network protections and monitor for unusual activity to mitigate risks until the update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for go-fdo-client.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
