Important: go-fdo-client security update
Summary
ALSA-2026:62577: Important: go-fdo-client security update. Affects go-fdo-client versions < 1.0.0-4.el10_2.7. Fixed in 1.0.0-4.el10_2.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding.
Security Fix(es):
- crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)
- encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
- net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
- crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
How To Fix
Minimum fixed version
1.0.0-4.el10_2.7
This is the first release that contains the fix.
sudo dnf update go-fdo-clientTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Related vulnerabilities
Recent vulnerabilities recorded for go-fdo-client.
