RHEL 10.0 EUS updates Ignition against certificate and hostname validation flaws

Red Hat has shipped an Important-rated Ignition security update for Red Hat Enterprise Linux 10.0 Extended Update Support, rebuilding the first-boot provisioning utility against fixes for two Go certificate and hostname-processing flaws. The advisory was issued Aug. 25 and supplies ignition-2.21.0-2.el10_0.3 for x86_64, AArch64, IBM Z and little-endian IBM Power systems.

Where the exposure sits

Ignition runs in the initramfs and applies machine configuration during first boot. Its inputs can arrive through a remote URL, a network metadata service or a hypervisor bridge, after which it can partition disks, format filesystems, write files and systemd units, and configure users. That makes the trust checks around an external configuration source part of the provisioning boundary.

One corrected flaw, CVE-2026-33810, is in Go's crypto/x509. Red Hat says excluded DNS constraints were not correctly applied to wildcard Subject Alternative Names when the SAN and constraint used different letter case. A malicious certificate from an otherwise trusted chain could therefore be accepted when it should have been rejected. Red Hat scores the issue 8.8, with network access and user interaction in its vector.

The second flaw, CVE-2026-39821, affects golang.org/x/net/idna. Crafted Punycode labels could pass an ASCII hostname authorization check and then normalize to a restricted hostname. Red Hat scores it 8.2 and says exploitation requires network reachability, high attack complexity and low privileges, but no user interaction.

For an Ignition deployment, practical exposure depends on whether the provisioning path consumes attacker-influenced hostnames, certificates or remote configuration sources. The advisory does not claim that every Ignition run is directly exploitable; it does state that earlier packages in the listed RHEL 10.0 EUS streams should be treated as vulnerable unless Red Hat explicitly marks them otherwise.

Fixed builds and verification

The update covers both the standard RHEL 10.0 EUS channels and the corresponding four-year update or support channels for all four architectures. The corrected binary package release is 2.21.0-2.el10_0.3; the advisory also rebuilds ignition-edge and ignition-validate at the same release.

Operators should apply the update before the next affected provisioning workflow. Red Hat's package-update guidance uses dnf upgrade for a full RHEL update or dnf upgrade ignition for the specific package. After repository metadata and updates are current, rpm -q ignition should report ignition-2.21.0-2.el10_0.3 or a later build from the same supported stream. Teams that stage immutable or installation images should also check the Ignition package embedded in those artifacts rather than only a long-running host, because the utility executes at first boot.