Skip to content
OpenAdvisories
High ALSA-2026:46394 1 CVE

Important: go-fdo-client security update

Published Jul 27, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding.

Security Fix(es):

* crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
AlmaLinux · 10 go-fdo-client 1.0.0-4.el10_2.5

Vulnerabilities 1

  • Medium 6.5
    CVE-2026-27145 Public exploit

    Inefficient candidate hostname parsing in crypto/x509

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification c…

    Go standard library crypto/x509 golang stdlib Debian Ubuntu Azure Linux Wolfi Go

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-27145
  • report
    https://bugzilla.redhat.com/2484207
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-46394.html