Summary
This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location.
Security Fix(es):
* encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
* net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
* crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
* crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
* net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 10 | go-fdo-server | 0:1.0.1-6.el10_3.9 |
| Rocky Linux · 10 | go-fdo-server | 0:1.0.1-6.el10_3.9 |
| Rocky Linux · 10 | go-fdo-server-debuginfo | 0:1.0.1-6.el10_3.9 |
| Rocky Linux · 10 | go-fdo-server-debuginfo | 0:1.0.1-6.el10_3.9 |
| Rocky Linux · 10 | go-fdo-server-debugsource | 0:1.0.1-6.el10_3.9 |
| Rocky Linux · 10 | go-fdo-server-debugsource | 0:1.0.1-6.el10_3.9 |
| Rocky Linux · 10 | go-fdo-server-manufacturer | 0:1.0.1-6.el10_3.9 |
| Rocky Linux · 10 | go-fdo-server-owner | 0:1.0.1-6.el10_3.9 |
| Rocky Linux · 10 | go-fdo-server-rendezvous | 0:1.0.1-6.el10_3.9 |
Vulnerabilities 5
-
High 7.5
Enforce maximum recursion depth in encoding/asn1
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
-
High 7.5
Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.
-
High 7.5
Limit handshake messages we are willing to accept post-handshake in crypto/tls
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key deriva…
-
High 7.5
Excessive CPU consumption from repeated initial window changes in net/http
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
-
High 7.5
Reject malformed ECH outer extension references in crypto/tls
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and …
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2548344
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2515827
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2515815
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2515839
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2548336
-
advisory
https://access.redhat.com/errata/RHSA-2026:98593