[ALSA-2026:5146] Important: yggdrasil security update
Type:
security
Severity:
important
Release date:
2026-03-20
Description:
yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Updated packages listed below:
Architecture Package Checksum
aarch64 yggdrasil-0.4.8-3.el10_1.aarch64.rpm b1861185423922cd989e184fcf619a1fe8852818095ca4c62944850ba87b7584
aarch64 yggdrasil-devel-0.4.8-3.el10_1.aarch64.rpm bd69872de25e9ca37c70a8c4ca5495c488b70b9d6b4c09447df742a6e259e3d8
ppc64le yggdrasil-devel-0.4.8-3.el10_1.ppc64le.rpm 5dc277835dc764efb66cccce7fee43cb8b439fb59ec1ec15566df584b3142440
ppc64le yggdrasil-0.4.8-3.el10_1.ppc64le.rpm cb0b120a9f400806a64ca48fb5dc4ce1cfeee62f89aa3d509e8765b3c762bfe2
s390x yggdrasil-devel-0.4.8-3.el10_1.s390x.rpm 319161b69f8d749bf45d41b79bca817d69260061cf807ee8ce93ee94cca579cc
s390x yggdrasil-0.4.8-3.el10_1.s390x.rpm ac620d43c5634769d07c6dffa20a810e8079d0af7ff359b8662a019f09da32be
x86_64 yggdrasil-devel-0.4.8-3.el10_1.x86_64.rpm 23c25f4c3870fddcd605443e38a1e03ea8c420132c9dc28ff1c8c273373540f3
x86_64 yggdrasil-0.4.8-3.el10_1.x86_64.rpm e3bf1514c9cd9c16dcdcd31d56e0825e984c548090f7396ef4b5991ddf48ef2e
x86_64_v2 yggdrasil-0.4.8-3.el10_1.x86_64_v2.rpm ea2838bd0a0c9caf3b3061f9de239be4b6539af9af064345ac596f805efd6a11
x86_64_v2 yggdrasil-devel-0.4.8-3.el10_1.x86_64_v2.rpm f4ffb837071f0fc51951aded4609d72b1663bac8d0c8f137e00e8b28e42856be
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.