Summary
go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding.
Security Fix(es):
* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)
* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
* golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 10 | go-fdo-client | 0:1.0.0-9.el10_3 |
| Rocky Linux · 10 | go-fdo-client | 0:1.0.0-9.el10_3 |
| Rocky Linux · 10 | go-fdo-client-debuginfo | 0:1.0.0-9.el10_3 |
| Rocky Linux · 10 | go-fdo-client-debuginfo | 0:1.0.0-9.el10_3 |
| Rocky Linux · 10 | go-fdo-client-debugsource | 0:1.0.0-9.el10_3 |
| Rocky Linux · 10 | go-fdo-client-debugsource | 0:1.0.0-9.el10_3 |
Vulnerabilities 4
-
Critical 9.6
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …
-
High 7.5
Incorrect parsing of IPv6 host literals in net/url
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
-
High 7.5
Incorrect enforcement of email constraints in crypto/x509
When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be…
-
High 7.5
Crash when handling long CNAME response in net
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.