The yggdrasil system daemon, which subscribes to MQTT broker topics and communicates with child worker processes via D-Bus, is affected by a denial of service vulnerability in the Go crypto/tls library (CVE-2026-32283). This vulnerability arises from the handling of multiple TLS 1.3 key update messages, potentially allowing an attacker to cause a denial of service condition. Red Hat has released an update for yggdrasil in Red Hat Enterprise Linux 10.0 Extended Update Support to fix this issue. The advisory references Red Hat Security Advisory RHSA-2026:19450 for details and remediation instructions.

Successful exploitation of this vulnerability could allow an attacker to cause a denial of service in the yggdrasil daemon by sending multiple TLS 1.3 key update messages. This may disrupt the normal operation of the daemon and its communication with worker processes. There are no reports of known exploits in the wild. The vulnerability is rated as Important by Red Hat, indicating a high impact on affected systems.

Red Hat has released an official security update for yggdrasil to address CVE-2026-32283. Users of Red Hat Enterprise Linux 10.0 Extended Update Support and related affected products should apply the update as detailed in Red Hat Security Advisory RHSA-2026:19450 and the associated article https://access.redhat.com/articles/11258. Applying this update will remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.