Aggregator

FEDORA-2026-fa08e0d381 Packages in this update:

• rust-rustls-0.23.46-1.fc44

Update description:

Update rustls to version 0.23.46. This includes fixes for four security vulnerabilities:

• RUSTSEC-2026-0346
• RUSTSEC-2026-0347
• RUSTSEC-2026-0348
• RUSTSEC-2026-0349

Release notes: https://github.com/rustls/rustls/releases/tag/v%2F0.23.46

Rebuilds of affected dependent applications are tracked in rust/backlog#43.

FEDORA-2026-4685ebea4f Packages in this update:

• rust-rustls-0.23.46-1.fc45

Update description:

Update rustls to version 0.23.46. This includes fixes for four security vulnerabilities:

• RUSTSEC-2026-0346
• RUSTSEC-2026-0347
• RUSTSEC-2026-0348
• RUSTSEC-2026-0349

Release notes: https://github.com/rustls/rustls/releases/tag/v%2F0.23.46

Rebuilds of affected dependent applications are tracked in rust/backlog#43.

FEDORA-2026-1ad5c5826b Packages in this update:

• qdigidoc-4.11.1-2.fc45

Update description:

• Upstream release 4.11.1

FEDORA-EPEL-2026-4645488364 Packages in this update:

• rust-backtrace-0.3.76-4.el9
• rust-object0.37-0.37.3-3.el9
• rust-object0.38-0.38.1-2.el9
• rust-object0.39-0.39.1-1.el9
• rust-object-0.40.0-1.el9
• rust-ruzstd-0.9.1-1.el9

Update description:

• Update the object crate to version 0.40.0.
• Add a compat package for version 0.39 of the object crate.
• Update the ruzstd crate to version 0.9.1.

This update also bumps the ruzstd dependency in packages for backtrace, object v0.37, v0.38, and v0.39 from v0.8 to v0.9 to address a potential decompression bomb vulnerability (assigned RUSTSEC-2026-0344).

Rebuilds of affected packages are tracked separately in rust/backlog#42.

FEDORA-EPEL-2026-4c9681f2f1 Packages in this update:

• rust-backtrace-0.3.76-4.el10_4
• rust-object0.37-0.37.3-3.el10_4
• rust-object0.38-0.38.1-2.el10_4
• rust-object0.39-0.39.1-1.el10_4
• rust-object-0.40.0-1.el10_4
• rust-ruzstd-0.9.1-1.el10_4

Update description:

• Update the object crate to version 0.40.0.
• Add a compat package for version 0.39 of the object crate.
• Update the ruzstd crate to version 0.9.1.

This update also bumps the ruzstd dependency in packages for backtrace, object v0.37, v0.38, and v0.39 from v0.8 to v0.9 to address a potential decompression bomb vulnerability (assigned RUSTSEC-2026-0344).

Rebuilds of affected packages are tracked separately in rust/backlog#42.

FEDORA-2026-9e7597548d Packages in this update:

• rust-backtrace-0.3.76-4.fc43
• rust-object0.37-0.37.3-3.fc43
• rust-object0.38-0.38.1-2.fc43
• rust-object0.39-0.39.1-1.fc43
• rust-object-0.40.0-1.fc43
• rust-ruzstd-0.9.1-1.fc43

Update description:

• Update the object crate to version 0.40.0.
• Add a compat package for version 0.39 of the object crate.
• Update the ruzstd crate to version 0.9.1.

This update also bumps the ruzstd dependency in packages for backtrace, object v0.37, v0.38, and v0.39 from v0.8 to v0.9 to address a potential decompression bomb vulnerability (assigned RUSTSEC-2026-0344).

Rebuilds of affected packages are tracked separately in rust/backlog#42.

FEDORA-2026-09783712f4 Packages in this update:

• rust-backtrace-0.3.76-4.fc44
• rust-object0.37-0.37.3-3.fc44
• rust-object0.38-0.38.1-2.fc44
• rust-object0.39-0.39.1-1.fc44
• rust-object-0.40.0-1.fc44
• rust-ruzstd-0.9.1-1.fc44

Update description:

• Update the object crate to version 0.40.0.
• Add a compat package for version 0.39 of the object crate.
• Update the ruzstd crate to version 0.9.1.

This update also bumps the ruzstd dependency in packages for backtrace, object v0.37, v0.38, and v0.39 from v0.8 to v0.9 to address a potential decompression bomb vulnerability (assigned RUSTSEC-2026-0344).

Rebuilds of affected packages are tracked separately in rust/backlog#42.

FEDORA-2026-e10e41c5b3 Packages in this update:

• rust-backtrace-0.3.76-4.fc45
• rust-object0.37-0.37.3-3.fc45
• rust-object0.38-0.38.1-2.fc45
• rust-object0.39-0.39.1-1.fc45
• rust-object-0.40.0-1.fc45
• rust-ruzstd-0.9.1-1.fc45

Update description:

• Update the object crate to version 0.40.0.
• Add a compat package for version 0.39 of the object crate.
• Update the ruzstd crate to version 0.9.1.

This update also bumps the ruzstd dependency in packages for backtrace, object v0.37, v0.38, and v0.39 from v0.8 to v0.9 to address a potential decompression bomb vulnerability (assigned RUSTSEC-2026-0344).

Rebuilds of affected packages are tracked separately in rust/backlog#42.

FEDORA-2026-d591b1e061 Packages in this update:

• rust-backtrace-0.3.76-4.fc46
• rust-object0.37-0.37.3-3.fc46
• rust-object0.38-0.38.1-2.fc46
• rust-object0.39-0.39.1-1.fc46
• rust-object-0.40.0-1.fc46
• rust-ruzstd-0.9.1-1.fc46

Update description:

• Update the object crate to version 0.40.0.
• Add a compat package for version 0.39 of the object crate.
• Update the ruzstd crate to version 0.9.1.

This update also bumps the ruzstd dependency in packages for backtrace, object v0.37, v0.38, and v0.39 from v0.8 to v0.9 to address a potential decompression bomb vulnerability (assigned RUSTSEC-2026-0344).

Rebuilds of affected packages are tracked separately in rust/backlog#42.

Stanislav Fort discovered that curl did not properly clear AWS SigV4 authentication state when CURLOPT_AWS_SIGV4 was set to NULL. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-86409) Stanislav Fort discovered that an HTTP proxy could trick libcurl into sending credentials to the proxy itself by responding to a CONNECT request with an unexpected authentication challenge. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-86414) Stanislav Fort discovered that curl did not correctly handle HSTS entries when an includeSubDomains parent entry was imported before a longer-lived child entry. An attacker could possibly use this issue to cause curl to use unencrypted HTTP connections. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-87862) Stanislav Fort discovered that curl did not properly handle HSTS max-age values that exceeded calendar time structure bounds. An attacker could possibly use this issue to cause a denial of service or data loss. This issue only affected Ubuntu 24.04 LTS. (CVE-2026-87863) Stanislav Fort discovered that curl did not properly handle IMAP APPEND commands when CURLOPT_CRLF was enabled, allowing overflow bytes to be interpreted as pipelined commands. An authenticated attacker could possibly use this issue to inject arbitrary IMAP commands. (CVE-2026-87864) Joshua Rogers discovered that libcurl had a use-after-free vulnerability in the FTP wildcard matching code. An attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-92388) Joshua Rogers discovered that libcurl's TFTP state machine did not properly validate transfer directions, allowing a malicious server to force the client into transmit mode. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-92389) Joshua Rogers discovered that curl had a stack overflow vulnerability when processing deeply nested MIME structures. An attacker could possibly use this issue to cause curl to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-92391) Joshua Rogers discovered that libcurl could expose credentials in the URL returned by CURLINFO_EFFECTIVE_URL when credentials were retrieved from a .netrc file. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-94266)

이지웅 discovered that Apache HTTP Server exposed WebDAV property information. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-58415) Zhen Kong and Charles Vosburgh discovered that Apache HTTP Server did not properly validate FTP server responses. A remote attacker could possibly use this issue to make a forward proxy connect to an arbitrary host. (CVE-2026-63045) Hyojae Lee and Zhen Kong discovered that Apache HTTP Server incorrectly handled certain HTTP requests. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-63292) Lucian Nitescu and Zhen Kong discovered that Apache HTTP Server did not properly handle certain responses from backend servers. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-63686) Qing Xu discovered that Apache HTTP Server incorrectly interpreted HTTP responses from backend servers. A remote attacker could possibly use this issue to perform HTTP response smuggling attacks. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-63718) Hyojae Lee discovered that Apache HTTP Server did not properly validate Digest authentication requests. A machine-in-the-middle attacker could possibly use this issue to bypass authentication. (CVE-2026-73636) Zhen Kong and Darren Carreras discovered that Apache HTTP Server did not properly manage authentication requests. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-73637) Vlatko Kosturjak discovered that Apache HTTP Server did not properly enforce access restrictions for user directories. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-79768) Zhen Kong discovered that Apache HTTP Server did not properly handle certain WebDAV requests. An authenticated user could possibly use this issue to cause a denial of service or corrupt WebDAV property data. (CVE-2026-93546)

FEDORA-2026-a8d1970e75 Packages in this update:

• golang-x-mobile-0-0.35.20261014git1977704.fc45

Update description:

Upgrade with minor security fixes

FEDORA-2026-596bcd713b Packages in this update:

• golang-x-mobile-0-0.35.20261014git1977704.fc44

Update description:

Upgrade with minor security fixes

Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled certain NFS READ and NFS READLINK responses. An attacker could possibly use this issue to trigger a buffer overflow, resulting in a denial of service or arbitrary code execution. (CVE-2026-74220, CVE-2026-74221) Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled certain HTTP data storage failures in its lwIP implementation. An attacker could possibly use this issue to trigger a use-after-free, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-74222) Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot did not properly validate certain DHCPv6 option lengths during network boot. An attacker could possibly use this issue to trigger out-of-bounds memory access, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-74225)

FEDORA-2026-a5783c8008 Packages in this update:

• erlang-26.2.5.21-10.fc43

Update description:

Backport fixes for CVE-2026-75538 (Erlang/OTP TCP driver: remote DoS via signed length overflow) and CVE-2026-73270 (Erlang/OTP inets httpd: information disclosure via case-insensitive path bypass).

FEDORA-2026-d47a436e71 Packages in this update:

• bind9-next-9.21.26-1.fc43

Update description: Update to 9.21.26 (rhbz#2489832) Security Fixes:

• Prevent excessive CPU use validating crafted DNSSEC responses. (CVE-2026-19668)
• Require a TSIG on every message of incoming zone transfers. (CVE-2026-19033)
• Prevent a DNSSEC downgrade of secure delegations via unrelated NSEC3 records. (CVE-2026-77119)
• Prevent forged DNSSEC-validated NXDOMAIN responses. (CVE-2026-19941)
• DNS64 with break-dnssec could cause an assertion failure. (CVE-2026-19666)
• Reject oversized negative cache records. (CVE-2026-19667)
• Prevent resolver crash with cached DNSSEC proofs. (CVE-2026-19662)
• Discard repeated SOA, CNAME, and DNAME records when parsing DNS messages. (CVE-2026-75029)
• Fix an unauthenticated crash on HTTPS using SIG(0). (CVE-2026-77692)
• Cached HTTPS/SVCB aliases could exhaust resolver CPU. (CVE-2026-81736)
• Prevent TKEY queries from terminating named without global options. (CVE-2026-76163)
• Out-of-zone records in a zone database could be served as authoritative. (CVE-2026-78301)
• Fix crash on wildcard answers carrying both NSEC and NSEC3 proofs. (CVE-2026-80274)
• Following HTTPS/SVCB aliases could leak resolver cache memory. (CVE-2026-81563)

Feature Changes:

• Reject oversized and malformed DNSKEY records up front.
• Reject out-of-zone records in zone transfers and zone files.

Removed Features:

• Remove the RFC 1918 reverse-lookup leakage warning.

FEDORA-2026-87d221ec8c Packages in this update:

• bind9-next-9.21.26-1.fc44

Update description: Update to 9.21.26 (rhbz#2489832) Security Fixes:

• Prevent excessive CPU use validating crafted DNSSEC responses. (CVE-2026-19668)
• Require a TSIG on every message of incoming zone transfers. (CVE-2026-19033)
• Prevent a DNSSEC downgrade of secure delegations via unrelated NSEC3 records. (CVE-2026-77119)
• Prevent forged DNSSEC-validated NXDOMAIN responses. (CVE-2026-19941)
• DNS64 with break-dnssec could cause an assertion failure. (CVE-2026-19666)
• Reject oversized negative cache records. (CVE-2026-19667)
• Prevent resolver crash with cached DNSSEC proofs. (CVE-2026-19662)
• Discard repeated SOA, CNAME, and DNAME records when parsing DNS messages. (CVE-2026-75029)
• Fix an unauthenticated crash on HTTPS using SIG(0). (CVE-2026-77692)
• Cached HTTPS/SVCB aliases could exhaust resolver CPU. (CVE-2026-81736)
• Prevent TKEY queries from terminating named without global options. (CVE-2026-76163)
• Out-of-zone records in a zone database could be served as authoritative. (CVE-2026-78301)
• Fix crash on wildcard answers carrying both NSEC and NSEC3 proofs. (CVE-2026-80274)
• Following HTTPS/SVCB aliases could leak resolver cache memory. (CVE-2026-81563)

Feature Changes:

• Reject oversized and malformed DNSKEY records up front.
• Reject out-of-zone records in zone transfers and zone files.

Removed Features:

• Remove the RFC 1918 reverse-lookup leakage warning.

FEDORA-2026-57cc6eadd3 Packages in this update:

• bind9-next-9.21.26-1.fc45

Update description: Update to 9.21.26 (rhbz#2489832) Security Fixes:

• Prevent excessive CPU use validating crafted DNSSEC responses. (CVE-2026-19668)
• Require a TSIG on every message of incoming zone transfers. (CVE-2026-19033)
• Prevent a DNSSEC downgrade of secure delegations via unrelated NSEC3 records. (CVE-2026-77119)
• Prevent forged DNSSEC-validated NXDOMAIN responses. (CVE-2026-19941)
• DNS64 with break-dnssec could cause an assertion failure. (CVE-2026-19666)
• Reject oversized negative cache records. (CVE-2026-19667)
• Prevent resolver crash with cached DNSSEC proofs. (CVE-2026-19662)
• Discard repeated SOA, CNAME, and DNAME records when parsing DNS messages. (CVE-2026-75029)
• Fix an unauthenticated crash on HTTPS using SIG(0). (CVE-2026-77692)
• Cached HTTPS/SVCB aliases could exhaust resolver CPU. (CVE-2026-81736)
• Prevent TKEY queries from terminating named without global options. (CVE-2026-76163)
• Out-of-zone records in a zone database could be served as authoritative. (CVE-2026-78301)
• Fix crash on wildcard answers carrying both NSEC and NSEC3 proofs. (CVE-2026-80274)
• Following HTTPS/SVCB aliases could leak resolver cache memory. (CVE-2026-81563)

Feature Changes:

• Reject oversized and malformed DNSKEY records up front.
• Reject out-of-zone records in zone transfers and zone files.

Removed Features:

• Remove the RFC 1918 reverse-lookup leakage warning.

Version:next-20261014 (linux-next) Released:2026-10-14

FEDORA-2026-0cc9a54ffe Packages in this update:

• erlang-26.2.5.21-10.fc44

Update description:

Backport fixes for CVE-2026-75538 (Erlang/OTP TCP driver: remote DoS via signed length overflow) and CVE-2026-73270 (Erlang/OTP inets httpd: information disclosure via case-insensitive path bypass).