High ELSA-2026-46395 2 CVEs

Important: go-fdo-server security update (Oracle Linux 10)

Published Jul 27, 2026 · Updated Jul 27, 2026

Ecosystem: Oracle Linux

Summary

[1.0.1-3]
- Rebuild against updated golang

Fixed packages 4

Release	Package	Fixed in
Oracle Linux · 10	go-fdo-server	0:1.0.1-2.el10_2.3
Oracle Linux · 10	go-fdo-server-manufacturer	0:1.0.1-2.el10_2.3
Oracle Linux · 10	go-fdo-server-owner	0:1.0.1-2.el10_2.3
Oracle Linux · 10	go-fdo-server-rendezvous	0:1.0.1-2.el10_2.3

Vulnerabilities 2

Critical 9.6

CVE-2026-39821

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …

Go standard library golang.org/x/net net/http net/http/internal/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go

May 22, 2026
Medium 6.5

CVE-2026-27145 Public exploit

Inefficient candidate hostname parsing in crypto/x509

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification c…

Go standard library crypto/x509 golang stdlib Debian Ubuntu Azure Linux Wolfi Go

Jun 2, 2026