Aggregator

FEDORA-2026-9de44775c7 Packages in this update:

• valkey-8.1.9-1.fc43

Update description: Valkey 8.1.9 - Released Tue 21 July 2026

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

Security Fixes

• CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234)
• CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073)

Bug Fixes

• Fix clients being left on the wrong database after module keyspace notifications from commands like MOVE and COPY by @enjoy-binbin (#4024)
• Fix an I/O thread job queue memory-ordering race that could trigger an assertion crash on ARM/aarch64 by @jjuleslasarte (#3878)
• Reject zipmap RESTORE payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds by @madolson (#3920)
• Reject NAN scores when loading listpack/ziplist-encoded sorted sets, preventing a crash from crafted RESTORE payloads by @madolson (#3921)
• Fix a startup crash when generating INFO output on 32-bit systems where time_t is 64-bit (e.g. Alpine time64) by @chenshi5012 (#3787)
• Fix COMMAND INFO in RESP3 to reply with an empty Array instead of a Set for commands without subcommands by @rickrams (#3939)
• Reject invalid characters in cluster AUX fields and cluster-announce-ip to prevent nodes.conf corruption and injection by @eifrah-aws (#3848)
• Fix lua-enable-insecure-api having no effect when enabled at startup via config file or command line by @enjoy-binbin (#3548)
• Increase the maximum process title length from 255 to 1024 characters to avoid truncation with long installation paths by @pkhartsk (#3843)

FEDORA-EPEL-2026-f5b9d860d8 Packages in this update:

• valkey-8.0.10-1.el8

Update description: Valkey 8.0.10 - Released Tue 21 July 2026

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

Security Fixes

• CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to crash the server using CLIENT KILL (#4234)
• CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers. Reported by @z0v3r1n and @lifip. (#4073)

Bug Fixes

• Strictly validate CRLF line endings when parsing the RESP protocol, rejecting malformed requests as protocol errors by @enjoy-binbin (#2872)
• Fix memory leak in ZDIFF/ZDIFFSTORE when the result set becomes empty before all input sets are processed by @sarthakaggarwal97 (#3342)
• Fix crash caused by a race between asynchronous client freeing and IO threads reading from the closing client by @deepakrn (#3458)
• Fix double free when loading corrupt stream RDB data containing duplicate consumer PEL entries by @enjoy-binbin (#3498)
• Fix stream corruption and crash when XTRIM marks the last entry of a listpack node as deleted by @smkher (#3591)
• Fix potential crash in TLS pending-data handling when the connection has no SSL object by @zuiderkwast (#3641)
• Fix use-after-free when ACL LOAD removes a user whose authenticated client's free is deferred by @ranshid (#3800)
• Fix use-after-free when a module unregisters the first-registered cluster message receiver for a message type by @eifrah-aws (#3846)
• Fix crash when loading functions after FUNCTION FLUSH ASYNC and make FUNCTION FLUSH actually release Lua VM memory by @enjoy-binbin (#1826)
• Fix file descriptor leak when a blocking connect times out, such as MIGRATE to an unreachable host by @madolson (#3541)
• Fix crash in module LRU/LFU API functions (GetLRU, SetLRU, GetLFU, SetLFU) when passed a NULL key by @yaronsananes (#3610)
• TLS synchronous I/O no longer leaves a blocking socket in non-blocking mode, preventing unexpected short reads by @xbasel (#1298)
• Fix crash when CLUSTER SLOTS is called without a real client connection, such as from a module timer callback by @bandalgomsu (#2915)
• Fix assertion crash in the IO thread job queue on ARM/aarch64 caused by memory store reordering by @jjuleslasarte (#3878)
• Reject zipmap RESTORE payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds by @madolson (#3920)
• Reject NAN scores in listpack and ziplist encoded sorted sets on RDB load, preventing a later crash on skiplist conversion by @madolson (#3921)
• Fix crash on 32-bit systems where time_t is 64-bit (e.g. Alpine with time64) when generating INFO output by @chenshi5012 (#3787)
• COMMAND INFO in RESP3 now returns an empty Array instead of a Set for the subcommands field of commands without subcommands by @rickrams (#3939)
• Manual failover votes are no longer restricted by two times the node timeout, preventing manual failover timeouts by @enjoy-binbin (#1305)
• Automatic failover votes are no longer restricted by two times the node timeout, matching the manual failover change by @enjoy-binbin (#1356)
• SENTINEL SET now rejects values containing control characters and config rewrite escapes them, preventing config injection by @eifrah-aws (#3847)
• Reject control characters and delimiters in cluster AUX fields and cluster-announce-ip to prevent nodes.conf injection by @eifrah-aws (#3848)
• Fix lua-enable-insecure-api yes not taking effect when set at startup via config file or command line by @enjoy-binbin (#3548)
• Log 'Connection reset by peer' instead of the misleading 'Success' when the connection to the primary closes during sync by @abmathur-ie (#3580)
• Redact key names and user data from additional server log messages when hide-user-data-from-log is enabled by @zackcam (#3872)
• Increase the maximum process title length from 255 to 1024 characters to avoid truncation with long paths by @pkhartsk (#3843)
• valkey-cli --cluster del-node can now remove unreachable or failed nodes instead of failing with 'No such node ID' by @yang-z-o (#3209)
• Fix valkey-cli --cluster assigning all uncovered slots to the same primary instead of distributing them randomly by @abmathur-ie (#3586)

FEDORA-2026-da44c3870f Packages in this update:

• dotnet8.0-8.0.129-2.fc43

Update description:

Update to .NET SDK 8.0.129 and Runtime 8.0.29

Fixes: CVE-2026-47300,CVE-2026-47302,CVE-2026-47303,CVE-2026-47304,CVE-2026-50524,CVE-2026-50525,CVE-2026-50526,CVE-2026-50527,CVE-2026-50528,CVE-2026-50646,CVE-2026-50648,CVE-2026-50649,CVE-2026-50650,CVE-2026-50651,CVE-2026-50659,CVE-2026-56158,CVE-2026-57108

Release Notes:

• SDK: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.29/8.0.129.md
• Runtime: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.29/8.0.29.md

USN-8580-1 fixed vulnerabilities in AccountsService. This update provides the corresponding fixes for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. Original advisory details: It was discovered that the Ubuntu-specific SetLanguage patch to AccountsService incorrectly handled dropping privileges. A local attacker could use this issue to execute arbitrary commands as an administrator. (CVE-2026-61897) It was discovered that the Ubuntu-specific SetLanguage helpers for AccountsService incorrectly handled parsing configuration files. A local attacker could use this issue to execute arbitrary commands. (CVE-2026-61898)

FEDORA-2026-9aef53fa96 Packages in this update:

• dotnet8.0-8.0.129-2.fc44

Update description:

Update to .NET SDK 8.0.129 and Runtime 8.0.29

Fixes: CVE-2026-47300,CVE-2026-47302,CVE-2026-47303,CVE-2026-47304,CVE-2026-50524,CVE-2026-50525,CVE-2026-50526,CVE-2026-50527,CVE-2026-50528,CVE-2026-50646,CVE-2026-50648,CVE-2026-50649,CVE-2026-50650,CVE-2026-50651,CVE-2026-50659,CVE-2026-56158,CVE-2026-57108

Release Notes:

• SDK: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.29/8.0.129.md
• Runtime: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.29/8.0.29.md

FEDORA-EPEL-2026-58bc6905cb Packages in this update:

• proftpd-1.3.9c-3.el10_3

Update description:

This update adds a new module, mod_procfs, which is enabled by default. It addressses CVE-2026-35025 (ACL bypass via /proc/self/root path prefix), by disallowing any file accesses via procfs filesystems.

FEDORA-EPEL-2026-8258136556 Packages in this update:

• proftpd-1.3.9c-3.el10_2

Update description:

This update adds a new module, mod_procfs, which is enabled by default. It addressses CVE-2026-35025 (ACL bypass via /proc/self/root path prefix), by disallowing any file accesses via procfs filesystems.

Zeng Yunxiang and Song Jiaxuan discovered that jbig2dec had an out-of-bounds read vulnerability in its command-line tool. An attacker could possibly use this issue to cause jbig2dec to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-46361) It was discovered that jbig2dec had an integer overflow in the jbig2_arith_iaid_ctx_new() function. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-38076)

It was discovered that libarchive did not properly manage memory when unpacking certain RAR5 archives, leading to a double free. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-14164) It was discovered that libarchive did not properly validate certain tar archives, leading to a buffer overflow. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-15028) It was discovered that libarchive did not properly validate certain malformed ACL entries. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-5745)

FEDORA-2026-f1fc7772c3 Packages in this update:

• kernel-7.1.4-102.fc43

Update description:

The 7.1.4-102/202 stable kernel updates contain a few important fixes across the tree.

The 7.1.4-101/201 stable kernel update contains a fix for a rather important security issue with net/can.

FEDORA-2026-2dd8b600bb Packages in this update:

• kernel-7.1.4-202.fc44

Update description:

The 7.1.4-102/202 stable kernel updates contain a few important fixes across the tree.

The 7.1.4-101/201 stable kernel update contains a fix for a rather important security issue with net/can.

FEDORA-2026-d314ce6051 Packages in this update:

• proftpd-1.3.9c-3.fc43

Update description:

This update adds a new module, mod_procfs, which is enabled by default. It addressses CVE-2026-35025 (ACL bypass via /proc/self/root path prefix), by disallowing any file accesses via procfs filesystems.

FEDORA-2026-2994824419 Packages in this update:

• proftpd-1.3.9c-3.fc44

Update description:

This update adds a new module, mod_procfs, which is enabled by default. It addressses CVE-2026-35025 (ACL bypass via /proc/self/root path prefix), by disallowing any file accesses via procfs filesystems.

It was discovered that the Ubuntu-specific SetLanguage patch to AccountsService incorrectly handled dropping privileges. A local attacker could use this issue to execute arbitrary commands as an administrator. (CVE-2026-61897) It was discovered that the Ubuntu-specific SetLanguage helpers for AccountsService incorrectly handled parsing configuration files. A local attacker could use this issue to execute arbitrary commands. (CVE-2026-61898)

Version:next-20260721 (linux-next) Released:2026-07-21

FEDORA-2026-e6bbab8aa8 Packages in this update:

• squid-7.6-1.fc44

Update description:

• new version 7.6

James Henstridge discovered that snapd's default apparmor template did not restrict access to systemd-userdbd varlink interface. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2024-5300) Qualys discovered that snap-confine can be tricked to create attacker-controlled files at certain privileged locations. A local attacker could possibly use this issue to bypass intended restrictions and escalate privileges to root. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-8933) Zygmunt Krynicki discovered that snapd's default seccomp template did not restrict the creation of executables with the set-user-ID attribute. A local attacker could possibly use this issue to create and execute setuid binaries. (CVE-2026-15226)