Aggregator

FEDORA-2026-239dbbff34 Packages in this update:

• opam-2.5.2-1.fc44

Update description:

Version 2.5.2 of opam fixes CVE-2026-57825. See https://github.com/ocaml/opam/releases/tag/2.5.2 for more information.

FEDORA-2026-fb48505840 Packages in this update:

• opam-2.5.2-1.fc43

Update description:

Version 2.5.2 of opam fixes CVE-2026-57825. See https://github.com/ocaml/opam/releases/tag/2.5.2 for more information.

FEDORA-2026-965be97ac0 Packages in this update:

• erlang-26.2.5.21-4.fc43

Update description:

Backport fixes for CVE-2026-48858 (ftp SSRF), CVE-2026-49759 (SCTP DoS), CVE-2026-48860 (dist-over-TLS auth bypass), CVE-2026-54886 (ssh SFTP DoS), CVE-2026-54891 (TLS handshake data injection), and CVE-2026-55952 (TLS 1.3 session ticket DoS). These are fixed upstream in OTP 27.x (rawhide/f45); backported here to the OTP 26.x line.

FEDORA-2026-dcf80dc1ff Packages in this update:

• erlang-26.2.5.21-4.fc44

Update description:

Backport fixes for CVE-2026-48858 (ftp SSRF), CVE-2026-49759 (SCTP DoS), CVE-2026-48860 (dist-over-TLS auth bypass), CVE-2026-54886 (ssh SFTP DoS), CVE-2026-54891 (TLS handshake data injection), and CVE-2026-55952 (TLS 1.3 session ticket DoS). These are fixed upstream in OTP 27.x (rawhide/f45); backported here to the OTP 26.x line.

FEDORA-2026-d70d93fcd7 Packages in this update:

• c-ares-1.34.8-1.fc43

Update description:

1.34.7 accidentally broke the API compatibility, this is fixed in 1.34.8.

• update to 1.34.7
• fixes CVE-2026-33630 (GHSA-6wfj-rwm7-3542) and GHSA-pjmc-gx33-gc76 and GHSA-jv8r-gqr9-68wj

FEDORA-2026-fbd55e52fb Packages in this update:

• python-dulwich-1.2.9-1.fc44

Update description:

1.2.9, CVE fixes

FEDORA-2026-c8f1a4ee05 Packages in this update:

• python-orjson-3.11.9-3.fc43

Update description:

Update PyO3 to 0.29, fixing RUSTSEC-2026-0194 and RUSTSEC-2026-0195.

FEDORA-2026-566791181a Packages in this update:

• p11-kit-0.26.4-1.fc43

Update description:

• server: fixed stack exhaustion via unbounded recursion in RPC attribute parsing by enforcing a recursion depth limit (CVE-2026-13757)
• fixed confusing error message when trying to store an existing cert with trust anchor
• fixed assert when parsing p11-kit files with value (")
• fixed numerous memory management issues
• Build and test fixes
• Updated translations

FEDORA-2026-695fd36daa Packages in this update:

• p11-kit-0.26.4-1.fc44

Update description:

• server: fixed stack exhaustion via unbounded recursion in RPC attribute parsing by enforcing a recursion depth limit (CVE-2026-13757)
• fixed confusing error message when trying to store an existing cert with trust anchor
• fixed assert when parsing p11-kit files with value (")
• fixed numerous memory management issues
• Build and test fixes
• Updated translations

Version:next-20260710 (linux-next) Released:2026-07-10

FEDORA-2026-dd78d37ecf Packages in this update:

• python-orjson-3.11.9-3.fc44

Update description:

Update PyO3 to 0.29, fixing RUSTSEC-2026-0194 and RUSTSEC-2026-0195.

FEDORA-2026-8893ec1aeb Packages in this update:

• python-uv-build-0.11.28-1.fc43
• rust-astral_async_zip-0.0.20-1.fc43
• uv-0.11.28-1.fc43

Update description:

Update uv / python-uv-build to 0.11.28, with significant hardening of zip file handling against parser differentials.

FEDORA-2026-3bc4b3ccb3 Packages in this update:

• webkitgtk-2.52.5-1.fc44

Update description:

• Fire scrollend event for instant programmatic scrolls.
• Increase network idle connection timeout to 115 seconds.
• Fix several crashes and rendering issues.
• Fix CVE-2024-4367, CVE-2026-39872, CVE-2026-43663, CVE-2026-43676, CVE-2026-43699, CVE-2026-43701, CVE-2026-43705, CVE-2026-43707, CVE-2026-43712, CVE-2026-43713, CVE-2026-43715, CVE-2026-43716, CVE-2026-43720, CVE-2026-43721, CVE-2026-43725, CVE-2026-43726, CVE-2026-43727, CVE-2026-43731, CVE-2026-43732, CVE-2026-43734, CVE-2026-43740, CVE-2026-43742, CVE-2026-43745

FEDORA-2026-ec8e535c6e Packages in this update:

• webkitgtk-2.52.5-1.fc43

Update description:

• Fire scrollend event for instant programmatic scrolls.
• Increase network idle connection timeout to 115 seconds.
• Fix several crashes and rendering issues.
• Fix CVE-2024-4367, CVE-2026-39872, CVE-2026-43663, CVE-2026-43676, CVE-2026-43699, CVE-2026-43701, CVE-2026-43705, CVE-2026-43707, CVE-2026-43712, CVE-2026-43713, CVE-2026-43715, CVE-2026-43716, CVE-2026-43720, CVE-2026-43721, CVE-2026-43725, CVE-2026-43726, CVE-2026-43727, CVE-2026-43731, CVE-2026-43732, CVE-2026-43734, CVE-2026-43740, CVE-2026-43742, CVE-2026-43745

FEDORA-EPEL-2026-c475a25098 Packages in this update:

• rust-astral_async_zip-0.0.20-1.el10_3
• uv-0.11.28-1.el10_3

Update description:

Update uv to 0.11.28, with significant hardening of zip file handling against parser differentials.

FEDORA-2026-be84487fdd Packages in this update:

• python-uv-build-0.11.28-1.fc44
• rust-astral_async_zip-0.0.20-1.fc44
• uv-0.11.28-1.fc44

Update description:

Update uv / python-uv-build to 0.11.28, with significant hardening of zip file handling against parser differentials.

FEDORA-2026-8fad0036a5 Packages in this update:

• sssd-2.13.1-3.fc45

Update description:

Automatic update for sssd-2.13.1-3.fc45.

Changelog * Wed Jul 8 2026 Sumit Bose <sbose@redhat.com> - 2.13.1-3 - CVE fixes: CVE-2026-12610 CVE-2026-14474 CVE-2026-14476 - rhbz#2494777: CVE-2026-12610 sssd: Use-after-free crash in SSSD' 'sssd_pam' process - rhbz#2497650: CVE-2026-14476 sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass - rhbz#2497651: CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation

FEDORA-2026-822c07add4 Packages in this update:

• python-idna-3.18-1.fc44

Update description:

Update to the latest version to bring fixes for CVE-2026-45409 and CVE-2024-3651 into the stable releases.

FEDORA-2026-6215e65f6c Packages in this update:

• python-idna-3.18-1.fc43

Update description:

Update to the latest version to bring fixes for CVE-2026-45409 and CVE-2024-3651 into the stable releases.

It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43284) It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43503) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - InfiniBand drivers; - SCSI subsystem; - Thermal drivers; - USB over IP driver; - Network file system (NFS) server daemon; - SMB network file system; - Tracing infrastructure; - B.A.T.M.A.N. meshing protocol; - Ethernet bridge; - Ceph Core library; - DCCP (Datagram Congestion Control Protocol); - IPv4 networking; - IPv6 networking; - Netfilter; - RxRPC session sockets; - X.25 network layer; (CVE-2021-47202, CVE-2024-56643, CVE-2026-23272, CVE-2026-23455, CVE-2026-31402, CVE-2026-31607, CVE-2026-31637, CVE-2026-31659, CVE-2026-31682, CVE-2026-31685, CVE-2026-43011, CVE-2026-43037, CVE-2026-43038, CVE-2026-43383, CVE-2026-43407, CVE-2026-43414, CVE-2026-45988, CVE-2026-46043, CVE-2026-46119, CVE-2026-46243)