Aggregator

haveged-1.9.27-1.fc44

Fedora Security Advisories
9 hours 21 minutes ago
FEDORA-2026-1ffac31a82 Packages in this update:
  • haveged-1.9.27-1.fc44
Update description:

Update to haveged 1.9.27

Update to 1.9.26. Fixes two regressions introduced in 1.9.24:

  • Fix 100% CPU spin when --no-command is used (BZ#2492029): socket_fd was uninitialized (defaulting to 0), causing the daemon loop to call accept4() on stdin in a tight loop.

  • Fix initramfs switch-root failure caused by --no-command (BZ#2491739): add a separate haveged-initramfs.service for use inside the initramfs, so the switch-root mechanism works. Prevents emergency mode on systems where haveged was started but not enabled.

Update to 1.9.25 — fix initramfs switch-root failure (BZ#2491739).

The v1.9.24 haveged.service with --no-command broke the initramfs switch-root handoff, causing emergency mode on systems where haveged was started but not enabled. Fix: add a separate haveged-initramfs.service for use inside the initramfs.

Update to 1.9.24. Disable command mode in long-running service (--no-command flag). Enable PrivateNetwork=true in systemd service. Remove SELinux policy module (no longer needed without command mode).

Fix rpminspect.yaml: use annocheck failure_severity instead of inspections toggle (annocheck is a security inspection and cannot be disabled via inspections section)

Update to 1.9.23-2: - Add SELinux policy module to allow semaphore creation in /dev/shm - Add rpminspect.yaml to waive pre-existing annocheck false positive

Security fixes in 1.9.23-1: - Use O_EXCL with sem_open to prevent semaphore pre-planting attacks - Fix OOB memory access in safein()/safeout() on socket errors - Reject command socket connections from different user namespaces - Use O_NOFOLLOW for PID file to prevent symlink attacks - Open random device with O_CLOEXEC, restrict semaphore to 0600 - Fix stale semaphore recovery after SIGKILL - Fix compilation when NO_COMMAND_MODE is defined

Update to 1.9.23 — security hardening: - Use O_EXCL with sem_open to prevent semaphore pre-planting attacks - Fix OOB memory access in safein()/safeout() on socket errors - Reject command socket connections from different user namespaces - Use O_NOFOLLOW for PID file to prevent symlink attacks - Open random device with O_CLOEXEC, restrict semaphore to 0600 - Fix stale semaphore recovery after SIGKILL - Fix compilation when NO_COMMAND_MODE is defined

nsd-4.15.3-1.fc43

Fedora Security Advisories
16 hours 28 minutes ago
FEDORA-2026-447c66a9bc Packages in this update:
  • nsd-4.15.3-1.fc43
Update description: Update to simdzone-0.2.7 with fixes for CVE-2026-101337, CVE-2026-101338, CVE-2026-101339 and CVE-2026-101341 Fix for CVE-2026-101337: Reserve correct number of bytes for base64 sequence tokens, regardless of stream decoder phase. Thanks to Qifan Zhang, Palo Alto Networks, and Gaurang Maheta for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101337.txt Fix for CVE-2026-101338: No SVCB and/or HTTPS parameters are parsed when the RDATA is already filled to the brim. Thanks to Qifan Zhang, Palo Alto Networks, for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101338.txt Fix CVE-2026-101339: Fix for dname possibility to overwrite the stack when near the RDATA limit. Thanks to Qifan Zhang, Palo Alto Networks, and Alwaleed Ashi (LXR) waleed.9998@hotmail.com for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101339.txt Fix for CVE-2026-101341: Also check that RDATA stays within bounds while parsing string tokens under 32 bytes. Thanks to Alwaleed Ashi (LXR) waleed.9998@hotmail.com for the report https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101341.txt

nsd-4.15.3-1.el10_2

Fedora Security Advisories
16 hours 28 minutes ago
FEDORA-EPEL-2026-f041c72fb8 Packages in this update:
  • nsd-4.15.3-1.el10_2
Update description: Update to simdzone-0.2.7 with fixes for CVE-2026-101337, CVE-2026-101338, CVE-2026-101339 and CVE-2026-101341 Fix for CVE-2026-101337: Reserve correct number of bytes for base64 sequence tokens, regardless of stream decoder phase. Thanks to Qifan Zhang, Palo Alto Networks, and Gaurang Maheta for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101337.txt Fix for CVE-2026-101338: No SVCB and/or HTTPS parameters are parsed when the RDATA is already filled to the brim. Thanks to Qifan Zhang, Palo Alto Networks, for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101338.txt Fix CVE-2026-101339: Fix for dname possibility to overwrite the stack when near the RDATA limit. Thanks to Qifan Zhang, Palo Alto Networks, and Alwaleed Ashi (LXR) waleed.9998@hotmail.com for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101339.txt Fix for CVE-2026-101341: Also check that RDATA stays within bounds while parsing string tokens under 32 bytes. Thanks to Alwaleed Ashi (LXR) waleed.9998@hotmail.com for the report https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101341.txt

nsd-4.15.3-1.el10_3

Fedora Security Advisories
16 hours 28 minutes ago
FEDORA-EPEL-2026-326e6032bd Packages in this update:
  • nsd-4.15.3-1.el10_3
Update description: Update to simdzone-0.2.7 with fixes for CVE-2026-101337, CVE-2026-101338, CVE-2026-101339 and CVE-2026-101341 Fix for CVE-2026-101337: Reserve correct number of bytes for base64 sequence tokens, regardless of stream decoder phase. Thanks to Qifan Zhang, Palo Alto Networks, and Gaurang Maheta for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101337.txt Fix for CVE-2026-101338: No SVCB and/or HTTPS parameters are parsed when the RDATA is already filled to the brim. Thanks to Qifan Zhang, Palo Alto Networks, for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101338.txt Fix CVE-2026-101339: Fix for dname possibility to overwrite the stack when near the RDATA limit. Thanks to Qifan Zhang, Palo Alto Networks, and Alwaleed Ashi (LXR) waleed.9998@hotmail.com for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101339.txt Fix for CVE-2026-101341: Also check that RDATA stays within bounds while parsing string tokens under 32 bytes. Thanks to Alwaleed Ashi (LXR) waleed.9998@hotmail.com for the report https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101341.txt

nsd-4.15.3-1.fc44

Fedora Security Advisories
16 hours 28 minutes ago
FEDORA-2026-24b48c1f89 Packages in this update:
  • nsd-4.15.3-1.fc44
Update description: Update to simdzone-0.2.7 with fixes for CVE-2026-101337, CVE-2026-101338, CVE-2026-101339 and CVE-2026-101341 Fix for CVE-2026-101337: Reserve correct number of bytes for base64 sequence tokens, regardless of stream decoder phase. Thanks to Qifan Zhang, Palo Alto Networks, and Gaurang Maheta for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101337.txt Fix for CVE-2026-101338: No SVCB and/or HTTPS parameters are parsed when the RDATA is already filled to the brim. Thanks to Qifan Zhang, Palo Alto Networks, for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101338.txt Fix CVE-2026-101339: Fix for dname possibility to overwrite the stack when near the RDATA limit. Thanks to Qifan Zhang, Palo Alto Networks, and Alwaleed Ashi (LXR) waleed.9998@hotmail.com for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101339.txt Fix for CVE-2026-101341: Also check that RDATA stays within bounds while parsing string tokens under 32 bytes. Thanks to Alwaleed Ashi (LXR) waleed.9998@hotmail.com for the report https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101341.txt

nsd-4.15.3-1.fc45

Fedora Security Advisories
16 hours 28 minutes ago
FEDORA-2026-3d49d46891 Packages in this update:
  • nsd-4.15.3-1.fc45
Update description: Update to simdzone-0.2.7 with fixes for CVE-2026-101337, CVE-2026-101338, CVE-2026-101339 and CVE-2026-101341 Fix for CVE-2026-101337: Reserve correct number of bytes for base64 sequence tokens, regardless of stream decoder phase. Thanks to Qifan Zhang, Palo Alto Networks, and Gaurang Maheta for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101337.txt Fix for CVE-2026-101338: No SVCB and/or HTTPS parameters are parsed when the RDATA is already filled to the brim. Thanks to Qifan Zhang, Palo Alto Networks, for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101338.txt Fix CVE-2026-101339: Fix for dname possibility to overwrite the stack when near the RDATA limit. Thanks to Qifan Zhang, Palo Alto Networks, and Alwaleed Ashi (LXR) waleed.9998@hotmail.com for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101339.txt Fix for CVE-2026-101341: Also check that RDATA stays within bounds while parsing string tokens under 32 bytes. Thanks to Alwaleed Ashi (LXR) waleed.9998@hotmail.com for the report https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101341.txt

nsd-4.15.3-1.el10_4

Fedora Security Advisories
16 hours 28 minutes ago
FEDORA-EPEL-2026-8eb91c1bcf Packages in this update:
  • nsd-4.15.3-1.el10_4
Update description: Update to simdzone-0.2.7 with fixes for CVE-2026-101337, CVE-2026-101338, CVE-2026-101339 and CVE-2026-101341 Fix for CVE-2026-101337: Reserve correct number of bytes for base64 sequence tokens, regardless of stream decoder phase. Thanks to Qifan Zhang, Palo Alto Networks, and Gaurang Maheta for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101337.txt Fix for CVE-2026-101338: No SVCB and/or HTTPS parameters are parsed when the RDATA is already filled to the brim. Thanks to Qifan Zhang, Palo Alto Networks, for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101338.txt Fix CVE-2026-101339: Fix for dname possibility to overwrite the stack when near the RDATA limit. Thanks to Qifan Zhang, Palo Alto Networks, and Alwaleed Ashi (LXR) waleed.9998@hotmail.com for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101339.txt Fix for CVE-2026-101341: Also check that RDATA stays within bounds while parsing string tokens under 32 bytes. Thanks to Alwaleed Ashi (LXR) waleed.9998@hotmail.com for the report https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101341.txt

nsd-4.15.3-1.el9

Fedora Security Advisories
16 hours 28 minutes ago
FEDORA-EPEL-2026-94e7fc5f94 Packages in this update:
  • nsd-4.15.3-1.el9
Update description: Update to simdzone-0.2.7 with fixes for CVE-2026-101337, CVE-2026-101338, CVE-2026-101339 and CVE-2026-101341 Fix for CVE-2026-101337: Reserve correct number of bytes for base64 sequence tokens, regardless of stream decoder phase. Thanks to Qifan Zhang, Palo Alto Networks, and Gaurang Maheta for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101337.txt Fix for CVE-2026-101338: No SVCB and/or HTTPS parameters are parsed when the RDATA is already filled to the brim. Thanks to Qifan Zhang, Palo Alto Networks, for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101338.txt Fix CVE-2026-101339: Fix for dname possibility to overwrite the stack when near the RDATA limit. Thanks to Qifan Zhang, Palo Alto Networks, and Alwaleed Ashi (LXR) waleed.9998@hotmail.com for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101339.txt Fix for CVE-2026-101341: Also check that RDATA stays within bounds while parsing string tokens under 32 bytes. Thanks to Alwaleed Ashi (LXR) waleed.9998@hotmail.com for the report https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101341.txt