Skip to content
OpenAdvisories
Medium RHSA-2026:46394 1 CVE

Red Hat Security Advisory: go-fdo-client security update

Published Jul 28, 2026 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.2 go-fdo-client 0:1.0.0-4.el10_2.5
Red Hat · RHEL 10 enterprise_linux:10.2 go-fdo-client-debuginfo 0:1.0.0-4.el10_2.5
Red Hat · RHEL 10 enterprise_linux:10.2 go-fdo-client-debugsource 0:1.0.0-4.el10_2.5

Vulnerabilities 1

  • Medium 6.5
    CVE-2026-27145 Public exploit

    Inefficient candidate hostname parsing in crypto/x509

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification c…

    Go standard library crypto/x509 golang stdlib Debian Ubuntu Azure Linux Wolfi Go

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2484207
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_46394.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-27145
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-27145
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-27145
  • article
    https://go.dev/cl/783621
  • article
    https://go.dev/issue/79694
  • article
    https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw
  • advisory
    https://pkg.go.dev/vuln/GO-2026-5037