Aggregator

perl-CGI-5.02-1.fc43

Fedora Security Advisories
5 days 23 hours ago
FEDORA-2026-a3a026d9ff Packages in this update:
  • perl-CGI-5.02-1.fc43
Update description:

5.02 bump - Fix CVE-2026-120631 (CGI::Cookie->parse backtracking DoS via cookie expires regex) - Fix CVE-2026-120632 (cubic regex backtracking via crafted multipart/related Content-Type) - Fix CVE-2026-120650 (missing/unenforced request size, param and upload limits) - Fix CVE-2026-120651 (infinite loop reading short PUT/POST/PATCH body with DISABLE_UPLOADS) - Fix CVE-2026-120645 (scrolling_list used submitted values as regex for optgroups) - Fix CVE-2026-120646 (uploadInfo() dereferenced plain strings as symbolic references) - Fix CVE-2026-120639 (header injection via HTML entity decoding in header() extra values) - Fix CVE-2026-120644 (CGI::Cookie path/domain/expires not checked; ";" injected attributes) - Fix CVE-2026-120647 (header() -attachment filename did not escape quotes) - Fix CVE-2026-120633 (url()/virtual_host() trusted client-supplied X-Forwarded-Host) - Fix CVE-2026-120638 (redirect() HTML-decoded URL after app checked it) - Fix CVE-2026-120636 (REQUEST_URI could produce protocol-relative or javascript: URLs) - Fix CVE-2026-120643 (url()/self_url() could contain raw single quote via URI->canonical) - Fix CVE-2026-120648 (comment() text could end HTML comment) - Fix CVE-2026-120634 (CGI::Carp warnings leaked between requests in persistent envs) - Fix CVE-2026-120635 (multipart parsing differentials; boundary smuggling) - Fix CVE-2026-120641 (upload filenames could contain path; path traversal risk) - Fix CVE-2026-120640 (POSTDATA/PUTDATA settable via query string/form field) - Fix CVE-2026-120642 (taint mode bypass for upload filename and other values) - Fix CVE-2026-120637 (unrecognised REQUEST_METHOD made argv the request params)

nginx-1.30.6-1.fc46 nginx-mod-brotli-1.0.0~rc-15.fc46 nginx-mod-fancyindex-0.6.0-10.fc46 nginx-mod-headers-more-0.40-5.fc46 nginx-mod-js-challenge-0^20230517.gitda6852d-13.fc46 nginx-mod-modsecurity-1.0.4-19.fc46 nginx-mod-naxsi-1.6-23.fc46 nginx-mod-vts…

Fedora Security Advisories
6 days 9 hours ago
FEDORA-2026-981a830ea5 Packages in this update:
  • nginx-1.30.6-1.fc46
  • nginx-mod-brotli-1.0.0~rc-15.fc46
  • nginx-mod-fancyindex-0.6.0-10.fc46
  • nginx-mod-headers-more-0.40-5.fc46
  • nginx-mod-js-challenge-0^20230517.gitda6852d-13.fc46
  • nginx-mod-modsecurity-1.0.4-19.fc46
  • nginx-mod-naxsi-1.6-23.fc46
  • nginx-mod-vts-0.2.7-3.fc46
Update description:

Update nginx stack to 1.30.6 to fix some CVEs: https://nginx.org/en/CHANGES-1.30

perl-HTTP-Parser-XS-0.18-1.el10_3

Fedora Security Advisories
6 days 9 hours ago
FEDORA-EPEL-2026-79b7b2864a Packages in this update:
  • perl-HTTP-Parser-XS-0.18-1.el10_3
Update description:

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

perl-HTTP-Parser-XS-0.18-1.el10_4

Fedora Security Advisories
6 days 9 hours ago
FEDORA-EPEL-2026-c4e44302ce Packages in this update:
  • perl-HTTP-Parser-XS-0.18-1.el10_4
Update description:

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.