Red Hat Security Advisory: go-fdo-client security update
go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding. Security Fix(es): * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
AI Analysis
Technical Summary
The Grafana plugin for Performance Co-Pilot, included in Red Hat Enterprise Linux 10, is affected by a denial of service vulnerability in the Go crypto/tls library (CVE-2026-32283). The flaw arises from handling multiple TLS 1.3 key update messages, which can be exploited to cause a denial of service condition. Red Hat has released updated packages for grafana-pcp to mitigate this issue. The advisory rates the impact as important and the CVSS vector indicates a high impact on availability with no confidentiality or integrity impact.
Potential Impact
Exploitation of this vulnerability can result in denial of service, disrupting availability of the affected Grafana plugin functionality. There is no impact on confidentiality or integrity of data. The vulnerability affects the TLS 1.3 implementation in the Go crypto/tls package used by the plugin.
Mitigation Recommendations
Red Hat has released updated packages for grafana-pcp in Red Hat Enterprise Linux 10 to address this vulnerability. Users should apply the security update as described in the Red Hat advisory (RHSA-2026:11881) to remediate the issue. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated.
Red Hat Security Advisory: go-fdo-client security update
Description
go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding. Security Fix(es): * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVSS v3.1
Score 7.5high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Grafana plugin for Performance Co-Pilot, included in Red Hat Enterprise Linux 10, is affected by a denial of service vulnerability in the Go crypto/tls library (CVE-2026-32283). The flaw arises from handling multiple TLS 1.3 key update messages, which can be exploited to cause a denial of service condition. Red Hat has released updated packages for grafana-pcp to mitigate this issue. The advisory rates the impact as important and the CVSS vector indicates a high impact on availability with no confidentiality or integrity impact.
Potential Impact
Exploitation of this vulnerability can result in denial of service, disrupting availability of the affected Grafana plugin functionality. There is no impact on confidentiality or integrity of data. The vulnerability affects the TLS 1.3 implementation in the Go crypto/tls package used by the plugin.
Mitigation Recommendations
Red Hat has released updated packages for grafana-pcp in Red Hat Enterprise Linux 10 to address this vulnerability. Users should apply the security update as described in the Red Hat advisory (RHSA-2026:11881) to remediate the issue. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:19450
- Cve Count
- 1
- Additional Cves
- []
- Cvss Version
- 3.1
Threat ID: 6a16097ce29bf47b50649124
Added to database: 05/26/2026, 20:58:36 UTC
Last enriched: 07/30/2026, 11:13:21 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 126
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.