Summary
go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding.
Security Fix(es):
* crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
* net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 10 | go-fdo-client | 0:1.0.0-9.el10_3.11 |
| Rocky Linux · 10 | go-fdo-client | 0:1.0.0-9.el10_3.11 |
| Rocky Linux · 10 | go-fdo-client-debuginfo | 0:1.0.0-9.el10_3.11 |
| Rocky Linux · 10 | go-fdo-client-debuginfo | 0:1.0.0-9.el10_3.11 |
| Rocky Linux · 10 | go-fdo-client-debugsource | 0:1.0.0-9.el10_3.11 |
| Rocky Linux · 10 | go-fdo-client-debugsource | 0:1.0.0-9.el10_3.11 |
Vulnerabilities 2
-
High 7.5
Limit handshake messages we are willing to accept post-handshake in crypto/tls
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key deriva…
-
High 7.5
Excessive CPU consumption from repeated initial window changes in net/http
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.