Summary
This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location.
Security Fix(es):
* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)
* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
* encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.
Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 10 | go-fdo-server | 0:1.0.1-6.el10_3 |
| Rocky Linux · 10 | go-fdo-server | 0:1.0.1-6.el10_3 |
| Rocky Linux · 10 | go-fdo-server-debuginfo | 0:1.0.1-6.el10_3 |
| Rocky Linux · 10 | go-fdo-server-debuginfo | 0:1.0.1-6.el10_3 |
| Rocky Linux · 10 | go-fdo-server-debugsource | 0:1.0.1-6.el10_3 |
| Rocky Linux · 10 | go-fdo-server-debugsource | 0:1.0.1-6.el10_3 |
| Rocky Linux · 10 | go-fdo-server-manufacturer | 0:1.0.1-6.el10_3 |
| Rocky Linux · 10 | go-fdo-server-owner | 0:1.0.1-6.el10_3 |
| Rocky Linux · 10 | go-fdo-server-rendezvous | 0:1.0.1-6.el10_3 |
Vulnerabilities 4
-
High 7.5
Incorrect parsing of IPv6 host literals in net/url
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
-
High 7.5
Incorrect enforcement of email constraints in crypto/x509
When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be…
-
High 7.5
Crash when handling long CNAME response in net
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
-
High 7.5
Add recursion depth guard during decode in encoding/xml
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.