Issued at: 2026-11-13
Updated at: 2026-11-14
Advisory content derived from Red Hat RHSA-2026:98592, © Red Hat, Inc., used under CC BY 4.0, with modifications.
Synopsis
Important: go-fdo-client security update
Description
go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding.
Security Fix(es):
* crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
* net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.